Valve, the video game publisher, has begun notifying European customers of a data breach at CEVA Logistics, its shipping partner for Steam hardware. The incident, which occurred between July 29 and August 1, 2026, potentially exposed personal information and order details for customers who purchased Steam hardware in Europe.
Valve stated that it was informed by CEVA Logistics on August 7, 2026, that a cyberattack likely compromised customer data. The affected information includes names, street addresses, postal codes, cities, countries, phone numbers, and email addresses associated with Steam accounts. Additionally, the type and price of the ordered hardware were exposed. CEVA Logistics retains this delivery information for up to 90 days post-order, and Valve is contacting all customers whose orders fall within this timeframe.
According to Valve, CEVA Logistics does not have access to sensitive data such as payment information, passwords, or Steam Guard codes, and these were not impacted by the breach. The company emphasized that no password changes or account setting adjustments are necessary for Steam accounts as a result of this incident.
Customers are being warned to be vigilant against potential phishing attempts via email, SMS, or phone calls. These fraudulent messages may reference specific hardware orders and personal addresses to appear legitimate, asking for confirmation of delivery, payment of small fees, or login credentials to verify orders. Valve advises treating all such communications as fake.
CEVA Logistics has reportedly isolated the compromised systems, taken them offline, and engaged external investigators to probe the incident. Valve is actively seeking more details from CEVA regarding the nature of the breach and the extent of the data compromised. The company is also in the process of notifying relevant data protection authorities in the affected European countries.
