Almost two weeks ago, we revealed the major changes that had happened this year in the major data breaches top of all times. 2011 was leading in what the number of high profile of breaches is concerned. The top might change once more, ensuring an even stronger position for the current year as hackers hit Steam, a gaming giant that is home to 35 million user accounts.

What we know so far is that the Steam customer data base has been indeed accessed by hackers.

“We learned that intruders obtained access to a Steam database in addition to the forums,”  said Gabe Newell, co-founder and managing director of Steam parent company Valve. “This database contained information including user names, hashed and salted passwords, game purchases, email addresses, billing addresses and encrypted credit card information.”

While the most sensitive account information was encrypted and there is no evidence that the hackers stole any of the details in the database or that they attempted to misuse any credit cards, Valve advises users to keep a close eye on credit card activity for the time being.

“We do not know of any compromised Steam accounts, so we are not planning to force a change of Steam account passwords, which are separate from forum passwords,” Newell’s statement explains. “However, it wouldn’t be a bad idea to change that as well.”

Let’s all keep our fingers crossed and hope only a few forum accounts have been compromised and the 35 million records are safe.

A data breach occurring at the Vacationland Vendors arcade games in Wisconsin Dells effected 40,000 credic and debit cards. The incident was caused by hackers who gained access to the card processing systems of the Wilderness Waterpark Resort in the Dells and Wilderness at the Smokies in Sevierville. The breach only affected the arcade systems, those using their credit cards for other services, such as reservations, eating at the resort restaurants or shopping for gifts have not been affected.

According to Vacationland Vendors, the hack was discovered on March 22, but it is believed that all cards used between December 12, 2008, to May 25, 2011. The good news is that the 40,000 cards exposed, company officials believe only 20 were actually impacted by the breach. 

Once the breach was discovered, Vacationland Vendors shut their card processing system down in both affected arcades and they are currently working with authorities and consultants to secure their system and prevent further intrusions.

The individuals whose credit and debit cards details have been breached are being notified of the incident by the credit card companies.

Photo source

Google’s web cache was recently caught red-handed, when payment card details of 19,000 UK based persons were discovered to be hosted by the world’s first and largest search engine. The stored data also included names, addresses, card numbers and expiry dates for Visa, MasterCard and American Express British holders. All anyone needed to do to discover the data was run the right search query.

The Register reported more on how the data got into Google’s cache:

The data was originally posted to a website server located in Vietnam, presumably in error by data thieves who wanted to sell it to other scammers. Even after the site was shuttered in February, the information continued to live on in Google’s web history cache until company employees finally purged it.

Luckily for part of those affected, many of the cards posted online had already been canceled, according to bank industry sources quoted by the Register. What about the others? Will they at least be notified?

The FBI has arrested 11 people in the case of the largest identity theft and data breach in history that targeted TJX and other companies. The suspects of which three are US citizens are believed to have taken part in the theft of over 40 million credit and debit card accounts from 9 major retailers and restaurants. Stealing that much data was possible after installing malicious software on the systems of TJX Companies, BJ’s Wholesale Club, OfficeMax, Barnes & Noble, Sports Authority, Forever 21, DSW, Dave & Busters and Boston Market.

Never surpassed in the time it has passed has been covered constantly by the media. The Reigster tells the story of the breach in a recent article: in the beginning of 2007, TJX first reported the a breach by unknown idividuals who had at the time stolen 46.5 million credit cards, number later proved to be twice as high. According to the Register, the fraud have been going on for quite a while when TJX reported it, as a year earlier industry watchers had noticed an unusual increse in debit card fraud at retailers OfficeMax and Sam’s Club.

US Attorney of Massachussets and the US Attorney General had both commented on the issue:

“While technology has made our lives much easier it has also created new vulnerabilities,” Michael J. Sullivan, US Attorney for the District of Massachusetts, said in a statement announcing the indictments. “This case clearly shows how strokes on a keyboard with a criminal purpose can have costly results.”

“They used sophisticated computer hacking techniques, breaching security systems and installing programs that gathered enormous quantities of personal financial data, which they then allegedly sold to others or used themselves,” US Attorney General Michael Mukasey said in prepared remarks. “And in total, they caused widespread losses by banks, retailers, and consumers.”

Other than having a sophisticated and high end technique of stealing the information, the ring of thieves also had multiple way to turn the theft into profit, either by selling the data to other criminals or by using it to create fake cards and withdraw thousands of dollars at a time.

The eleven arrested individuals are from the United States, Estonia, Ukraine, the People’s Republic of China and Belarus. The FBI is still in pursuit of another member of the group who is only known by his online alias and continues to elude authorities. Let’s hope he’s caught soon enough!

Over 100 shoppers at a supermarket in Los Gatos, California, became victims of identity theft when their private records have been stolen from their debit and credit cards through the checkout card reader. The thieves from the Lunardi’s grocery store used the stolen PIN numbers and card information to create fake cards which were subsequently use them to shop around.

The supermarket customers have been reporting cases of identity theft to authorities for over a week, and according to Dark Reading have been losing an average of $1,000 from their bank accounts.

“What we have here is more than one person — they’ve been able to get in there (Lunardi’s) and switch out the ATM card reader,” said Los Gatos-Monte Sereno police Sgt. Tam McCarty in an article in the San Jose Mercury News. “Once they’ve done that, they can read the card and PIN numbers and either make a temporary card or sell the numbers over the phone.”