Did steam's user information leak? On March 12, 2022, I was harassed by the correct account name and password login verification email all day.

[世纪伯乐]

Poor English, machine translation.

steam的用户信息泄漏了么？2022.03.12，整整一天被正确的账户名称与密码登录验证邮件骚扰。
Did steam's user information leak? On March 12, 2022, I was harassed by the correct account name and password login verification email all day.


今天一天收到了大量来自steam的邮件，我的帐号被人使用正确的账户名称与密码登录，这不是我在登录。我已经连续更改了很多很多次密码，但是每次更改后没过多长时间继续收到被正确的账户名称与密码登录邮件。
I received a lot of emails from steam today. My account was logged in with the correct account name and password. This is not me logging in. I have changed my password many times in a row, but I have received the login email with the correct account name and password for long after each change.

邮件里提供了恶意登录的ip地址，这些ip地址都不是我所在的地区。希望官方解决一下我的困扰。
The email provides malicious login IP addresses, which are not my region. I hope the authorities can solve my problem.


221.230.233.100
121.230.46.19
121.230.170.16
121.230.170.226
180.122.103.244
49.85.110.132
49.71.163.231
117.94.116.189

[Cathulhu]

There is no known leak.
Keep in mind that Valve does use industry standard security measures by not actually storing your password, but only a HASH that was additionally made harder to use by SALTing it.

https://en.wikipedia.org/wiki/Hash_function
https://en.wikipedia.org/wiki/Salt_(cryptography)

So, even if there was a leak, that data would be pretty much unusable to get your actual password. Not without eons of time.

Most likely you leaked your password somehow.

https://haveibeenpwned.com/
Check for yourself.

If it still happens after a password change, then you are still leaking the password.

[Crazy Tiger]

Originally posted by 世纪伯乐:

I have changed my password many times in a row, but I have received the login email with the correct account name and password for long after each change.

Best to do a thorough malware scan, chances are you have a keylogger somewhere.

[世纪伯乐]

Thanks. I'll try changing my password a few more times.

[世纪伯乐]

Originally posted by Crazy Tiger:

Originally posted by 世纪伯乐:

I have changed my password many times in a row, but I have received the login email with the correct account name and password for long after each change.

Best to do a thorough malware scan, chances are you have a keylogger somewhere.

I will. Thank you for your prompt.

[世纪伯乐]

Originally posted by 世纪伯乐:

Thanks. I'll try changing my password a few more times.

I changed a computer to operate the steam web.


I wrote a random string generator as a password.


After a while, I got the email to login with the correct username and password again.

I don't think such passwords are still leaked.

Originally posted by Crazy Tiger:

Originally posted by 世纪伯乐:

I have changed my password many times in a row, but I have received the login email with the correct account name and password for long after each change.

Best to do a thorough malware scan, chances are you have a keylogger somewhere.

[世纪伯乐]

Originally posted by Crazy Tiger:

Originally posted by 世纪伯乐:

I have changed my password many times in a row, but I have received the login email with the correct account name and password for long after each change.

Best to do a thorough malware scan, chances are you have a keylogger somewhere.

The new malicious login ip is: 121.230.171.240

[Joke]

Please check that the account name on those emails is exactly the same as you use to login to steam.

It could be that you have another account that you forgot about, and that it's that account that is being targeted.

1. Use a web browser, and go to https://store.steampowered.com/
2. Log out if you are logged in, and then go to the login page.
3. Click the "Forgot your password" link.
4. Then click the "I forgot my steam account name or password".
5. Now you can search for accounts connected to your email.

[Muppet among Puppets]

The hello name in the email gives away if its about your account.
But only if that name is unique to your steam account, and not for example is also part of your email or profile.

[世纪伯乐]

Originally posted by Joke:

Please check that the account name on those emails is exactly the same as you use to login to steam.

It could be that you have another account that you forgot about, and that it's that account that is being targeted.

1. Use a web browser, and go to https://store.steampowered.com/
2. Log out if you are logged in, and then go to the login page.
3. Click the "Forgot your password" link.
4. Then click the "I forgot my steam account name or password".
5. Now you can search for accounts connected to your email.

Thank you for your wonderful idea,

After careful inspection, I found that the account in the email is different from the account I used. The account attacked by malicious login is an account I haven't used for many years. Two accounts are bound to the same mailbox.



That account is the target account I was attacked. After I logged in to the old account and changed my password, the whole world was finally quiet.



I have received correct login emails for more than 20 hours in a row. Changing my password has also been attacked by malicious login all the time. The attacker seems to be trying to violently collide with my verification code in the way of infinite trial.



Thank you very much for your help.