Valve was hacked by MaddoxX from No-Steam. Apparently Valve hasn't admitted to being hacked and they are deleting any threads made about it on the Steam forums. It is unknown whether or not the Credit Card's taken during this inflitration into Valve are from all users or just the cafe users.
If they were hacked and customers private information as well as credit card information was exposed then Valve is doing a huge disservice to it's customers by not issuing a statement. A company should inform their customers immediately anytime sensitive data like this is hacked into. This allows customers to take the necessary steps to protect themselves, such as canceling their credit cards. To pretend that something like this never occurred is very dishonest of a company.