Here at Ars, we’re intimately familiar with data leaks surrounding Valve’s games, hardware, and the workings of Steam itself. But nothing could have prepared us for this weekend’s “terarelease” encompassing more than 12TB of content related to seemingly every title available on Steam between 2003 to 2013. What’s being sold as an “as-complete-as-possible … content server dump” of Steam’s defunct “Steam2” server architecture from that time period is now circulating around via a BitTorrent tracker that Valve seems unlikely to ever completely purge from the Internet.
The massive collection includes thousands of “depots” representing what seems to be every version of every game uploaded to those old Steam2 servers. That includes public release builds, of course, but in many cases also covers previously unseen pre-release, prototype, and playtest versions of popular titles published by Valve and third-party Steam publishers. The reason this weekend’s leaked content cuts off abruptly in 2013 is because that’s when Valve updated its content distribution system from “Steam2” to the current SteamPipe system.
In moving from a proprietary file distribution format to standard HTTP file trees, the new system removed various update approval bottlenecks on Valve’s end and streamlined update and patch downloads so they only reflected file differentials. Publicly accessible early versions of some games released before this SteamPipe transition had been considered lost content by archivists, no longer accessible from Valve itself and living on only as local downloads on aging machines. Apparently all that content wasn’t as lost as many thought, though.
Longtime Valve watcher and data miner Gabe Follower (previously) wrote on social media this weekend that he had “verified that everything in Steam2 Teraleak was obtained via a publicly accessible [API] endpoint. It’s Valve’s fault…” Spanish-language Valve streamer and analyst Scolcer also said on social media (via machine translation) that the teraleak was “obtained from a site that was 100% accessible to the public. It was there for everyone to download.
Hidden in plain sight, but with no protection whatsoever.”
Extract — continue reading at the source.
