Valve has begun notifying European customers who purchased Steam hardware that their personal information may have been exposed due to a cyberattack targeting CEVA Logistics, its regional shipping partner. The attack, which occurred between July 29 and August 1, 2026, specifically targeted "delivery-related information" that Valve provides to CEVA Logistics for fulfilling hardware orders.
Valve learned of the incident on August 7 and subsequently identified customers at risk. The compromised information "likely" includes names, street addresses, phone numbers, email addresses, and order details for affected European customers. Valve has stressed that customers should be vigilant against fraudulent communications that may use this compromised information to appear legitimate.
However, Valve stated that Steam account passwords do not need to be changed, as the shipping partners are not provided with customer payment information or other non-delivery related data. This means unrelated Steam account details should remain secure.
CEVA Logistics, headquartered in France, confirmed the cyberattack and stated that its investigation into the incident is ongoing. The attack reportedly affected eight CEVA warehouse hubs, leading to shipping delays for its retail partners across Europe. The full scope of the data breach and the total number of affected users are still being determined as Valve continues to press CEVA for details and works with data protection authorities in relevant European countries.