&gt; In the end I am guessing the blame will be shifted onto the group that was DDOSing steam earlier today instead of Valve running a configuration where this type of breach was possible.<p>I doubt it. The &quot;fail-state&quot; for their website should be to just not work, vs expose other people&#x27;s credentials. If it was proven that the attackers were able to change server configs, that&#x27;d be one thing, but that doesn&#x27;t seem to be the case.