Valve warns Steam hardware customers after CEVA Logistics data breach

Valve has notified European customers who bought Steam hardware that personal delivery and order data was likely stolen after a cyberattack on shipping partner CEVA Logistics. The company said attackers had access to CEVA servers between July 29 and August 1, 2026, exposing names, addresses, phone numbers, email addresses, and the type and price of ordered products tied to Steam hardware shipments, including older purchases such as Steam Machines and Steam Controllers.

Valve said the breach was limited to fulfillment data held by CEVA and did not expose Steam account credentials, payment card information, or Steam Guard codes. The company warned affected customers to expect phishing emails, text messages, and phone calls impersonating Valve, Steam, or delivery firms, including scams requesting customs or delivery fees or login details. CEVA said it isolated affected systems, notified data protection authorities, and brought in external investigators after the attack also disrupted operations at eight European warehouses.