Valve, the company behind the Steam digital distribution platform, has begun notifying European hardware customers of a data breach stemming from a cyberattack on its shipping partner, CEVA Logistics. The incident, which Valve learned about on August 7, compromised personal information necessary for shipping hardware orders.
According to Valve's notifications, the attackers had access to CEVA Logistics' servers between July 29 and August 1, 2026. During this period, data including customers' names, addresses, phone numbers, email addresses, and details about the type and price of products ordered were likely stolen. Valve emphasized that no payment information, passwords, Steam Guard codes, or other sensitive Steam account data were impacted, as CEVA Logistics does not handle such information.
CEVA Logistics, a subsidiary of the CMA CGM Group, is a major global shipping company. Valve's notification emails indicate that CEVA retains shipping information for up to 90 days post-order, leading Valve to contact all customers potentially affected within that timeframe.
Valve has advised customers to be vigilant against potential phishing attempts via email, SMS, or voice calls. Attackers may leverage the stolen information, such as addresses, to appear legitimate while impersonating Steam, Valve, or delivery companies. Customers are warned against requests for delivery confirmation, small fees, or account verification, and are reassured that there is no need to change Steam passwords or account settings.
CEVA Logistics has isolated the affected systems, taken them offline, and engaged external investigators. Valve is pressing CEVA for a full understanding of the scope and method of the data exfiltration and is in the process of notifying relevant data protection authorities in affected countries. The disclosure follows CEVA Logistics' August 1 notification to multiple European retailers regarding a cyberattack that disrupted operations at eight of its European warehouses.
