On Christmas Day, Steam showed you someone else's account.

transcript

Christmas Day. You open your Steam account page. It's not yours. Someone else's billing address. Their purchases. The villain? One cache setting.

Early Christmas morning, the Steam Store is under attack. Denial of service. Traffic is up 2000 percent over the sale's average.

So caching rules go in, run by a caching partner. Serve copies from the edge. One copy, served to everyone. The servers get to breathe. Perfect for a store page that looks the same for all.

Then a second wave hits. A second cache config goes out. And this one caches pages for logged-in users. Your page, built for you, handed to the next person.

From 11:50 to 13:20, about 34,000 users' pages may have been seen. Addresses. Purchase history. Emails. Last two digits of a card. No full card numbers. No passwords. Nobody could log in as you.

Valve shut the whole Steam Store down. On Christmas. It reviewed every cache config. Then purged every edge server.

A cache must know whose page it's holding. Never cache personal pages at a shared edge. Not even mid-attack.

Full story in the article.