A cyberattack on CEVA Logistics, a shipping partner for Valve's Steam hardware in Europe, may have exposed the personal information of Steam customers. The incident reportedly occurred between July 29 and August 1, 2026, with Valve being notified on August 7.
According to an email from Valve shared by Gaming On Linux and Reddit users, CEVA Logistics handles delivery information for Steam hardware shipments in Europe. This data, which includes customer names, phone numbers, email addresses, and postal addresses, is retained by CEVA for up to 90 days after an order is completed. Valve has stated that it is contacting all customers it believes may have been impacted by the breach.
Valve's email clarifies that the compromised information does not include payment details, passwords, or Steam Guard codes. However, affected users are warned to anticipate potential phishing attempts. These may manifest as fake emails, SMS messages, or phone calls impersonating Steam, Valve, or delivery companies. Such fraudulent communications might use the customer's address to appear legitimate and could request confirmation of delivery, payment of small fees, or verification of order details through suspicious links or login portals.
Steam Support has stated it will never handle issues via email, Steam chat, or Discord. Users are advised to be cautious of any unsolicited communications and to avoid clicking links in suspicious emails, instead navigating directly to the Steam store website. Sharing passwords or Steam Guard codes with any party is strongly discouraged.
Valve is reportedly working with CEVA Logistics to determine the full scope of the data breach and is in the process of notifying data protection authorities in the affected European countries.