Valve has alerted customers who purchased Steam hardware, including Steam Machines and Steam Controllers, to a potential data breach that affected their European shipping partner, CEVA Logistics. The logistics company notified Valve of the cyberattack on August 7, which may have resulted in the compromise of sensitive user information.
The compromised data includes customer names, physical addresses, countries, phone numbers, Steam email addresses, and details about their hardware purchases. Valve has stated that payment information and user passwords were not exposed in this incident. This breach follows a pattern of increasing cyberattacks affecting various companies in the gaming industry, with past incidents involving GameFreak and Insomniac Games.
Valve is advising affected users to be vigilant against potential phishing attempts. Scammers may use the stolen information to send fraudulent communications via email, SMS, or phone calls, appearing to be from Steam, Valve, or a delivery service. These messages could reference order details, such as the user's address, to feign legitimacy. They might request confirmation of deliveries, payment for customs or redelivery fees, or prompt users to log in to "verify" their order. Valve emphasized that Steam Support does not communicate with users through email, Steam Chat, or Discord, and all account-related issues are handled exclusively through the official help page. Users are urged to avoid clicking on any login links within these suspicious messages and to never share their passwords or Steam Guard codes with anyone claiming to be Steam Support or a courier.
This incident is one of several data security events impacting the gaming landscape. Recent threats have also targeted major titles like Grand Theft Auto 6, with fake beta key websites and phishing attempts aimed at Rockstar Social Club accounts. Valve previously addressed reports of a large-scale data breach last year, clarifying that the exposed data involved older, unencrypted SMS authentication messages that did not contain sensitive personal details.