Incident: A cache that served one user's page to another

Module 7 · Incident file · About 30 minutes

What happened

On Christmas Day 2015 the Steam Store, Valve's games shop, showed some signed-in users pages that had been generated for other users. Valve explained it on 30 December in "Update on Christmas Issues" (Valve, 2015). Early that morning, Pacific time, the store was hit by a denial-of-service attack; traffic rose "2000% over the average traffic during the Steam Sale". Caching rules, managed by a web caching partner, were deployed to protect the store's servers. During a second wave, "a second caching configuration was deployed that incorrectly cached web traffic for authenticated users."

Between 11:50 and 13:20 PST, store page requests for "about 34k users", which contained personal information, "may have been returned and seen by other users". Some pages showed a billing address, the last four digits of a Steam Guard phone number, purchase history, the last two digits of a card number or an email address. Valve says the pages did not include full card numbers or passwords, or enough to sign in or buy as another user. The wrong responses ranged from "the front page of the Store displayed in the wrong language" to "the account page of another user". Valve shut the store, reviewed every caching configuration and purged the cached data before reopening.