Valve has alerted customers in Europe who purchased Steam Machines or Steam Controllers to be vigilant against fraudulent communications. The company's own servers remain secure, but a data breach has affected one of its key European hardware distribution partners.
CEVA Logistics, responsible for distributing Valve's hardware across the continent, experienced a security incident on August 7. The company subsequently informed Valve, prompting the PC gaming giant to issue a warning to its customers.
While the compromised data does not include sensitive financial information such as passwords or payment details, it may contain personal information including names, addresses, phone numbers, countries of residence, and Steam account email addresses. Crucially, the breach may also have exposed details related to specific hardware purchases made by affected users.
Valve stated that malicious actors could potentially use this information to craft convincing phishing messages, such as fake emails, SMS messages, or phone calls, that appear to originate from Steam, Valve, or delivery services. These fraudulent communications might reference a customer's hardware order and even include their address to lend an air of authenticity. Customers may be prompted to confirm deliveries, pay small customs or redelivery fees, or click links to "verify" their orders.
Valve explicitly advised customers to treat all such communications as fake. The company is pressing CEVA Logistics for a comprehensive understanding of the breach's scope and the exact nature of the data compromised. Valve has also confirmed it is in contact with data protection authorities in the affected European countries.
Valve noted that CEVA Logistics retains specific delivery-related information from Steam orders for up to 90 days after an order is fulfilled. This duration is why Valve is extending its warning to all customers who might have been impacted within that timeframe. Investigations into the attack are ongoing by CEVA Logistics.