Valve is contacting a number of Steam users who purchased hardware in Europe to inform them of a data breach affecting its shipping partner, CEVA Logistics. The cyberattack occurred between July 29 and August 1, with Valve learning of the incident on August 7. Users have reported receiving emails from Valve detailing the breach.
While Valve's communications explicitly state that Steam account information and purchase details were not compromised, personal data such as names, addresses, and phone numbers may have been accessed. This information is relevant to customers in Europe who bought Steam hardware. CEVA Logistics retains user data for up to 90 days after an order is placed, suggesting that purchases made from early August onwards could be affected. Valve has cautioned affected users to be wary of potential phishing attempts via email, SMS, or phone calls that mimic communications from Steam, Valve, or delivery companies.
Neither Valve nor CEVA Logistics has issued a public statement regarding the incident. The precise number of Steam customers whose information was leaked remains unconfirmed.