Loading story…
Valve has notified European customers who bought Steam hardware that personal delivery and order data was likely stolen after a cyberattack on shipping partner CEVA Logistics. The company said attackers had access to CEVA servers between July 29 and August 1, 2026, exposing names, addresses, phone numbers, email addresses, and the type and price of ordered products tied to Steam hardware shipments, including older purchases such as Steam Machines and Steam Controllers.
Valve said the breach was limited to fulfillment data held by CEVA and did not expose Steam account credentials, payment card information, or Steam Guard codes. The company warned affected customers to expect phishing emails, text messages, and phone calls impersonating Valve, Steam, or delivery firms, including scams requesting customs or delivery fees or login details. CEVA said it isolated affected systems, notified data protection authorities, and brought in external investigators after the attack also disrupted operations at eight European warehouses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Valve said it is notifying data protection authorities in affected countries following the CEVA Logistics breach affecting European Steam hardware customer data. The statement accompanied Valve's customer notifications about the likely exposure of shipping and order information.
Valve began notifying affected Steam hardware customers in Europe about the CEVA Logistics breach and warned them to expect phishing emails, texts, or calls impersonating Steam, Valve, or delivery firms. Valve also said no Steam account credentials, payment information, or Steam Guard codes were exposed.
Valve said it learned on August 7, 2026 that attackers had stolen information tied to European Steam hardware orders handled by CEVA Logistics. The exposed data likely included names, addresses, phone numbers, email addresses, and product type and price.
Bol said the Dutch Data Protection Authority was informed on August 3, 2026 about the possible customer data leak tied to the cyberattack on CEVA Logistics. The notification followed CEVA's August 1 alert to Bol and preceded customer emails sent after further investigation.
Multiple organizations, including Bol, De Bijenkorf, Ajax, ING, and Ace & Tate, reported that customer shipping information held by CEVA Logistics was affected by the incident. Some also disclosed operational fallout such as order delays and cancellations tied to the disruption at CEVA's European warehouses.
The Dutch Data Protection Authority and other law enforcement agencies were reported to be investigating the CEVA Logistics cyber incident affecting eight European warehouses. The investigation was disclosed alongside retailer notices describing operational disruption and possible exposure of customer shipping data.
CEVA Logistics informed multiple European retailers that a cyberattack had disrupted operations at eight of its warehouses in Europe. This disclosure was reported as occurring on August 1, 2026.
Valve said attackers had access to CEVA Logistics servers during a cyberattack affecting its European hardware distribution operations. The intrusion window was stated as July 29, 2026 through August 1, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcetechcrunch.com
Open sourcecybersecuritynews.com
Open sourcetomshardware.com
Open sourcebleepingcomputer.com
Open sourcedigitalfoundry.net
Open sourcereddit.com
Open sourcefreightwaves.com
Open sourcenos.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch retailer **Bol** warned customers that some personal information may have been viewed or copied after unauthorized parties accessed systems at **CEVA Logistics**, a logistics partner that processes and delivers orders from one of Bol’s distribution centers. Bol said its own environment was not compromised, but customer data linked to the partner’s operations was affected, and reports indicated the stolen information was being offered for sale on the dark web. The disclosure followed a similar warning from **De Bijenkorf**, which also linked its incident to a logistics partner and said the breach likely affected customer data. Reporting suggested the two cases are related, pointing to a broader third-party supply-chain compromise centered on CEVA Logistics, with De Bijenkorf also experiencing order-processing delays as the incident disrupted operations.
Aug 7, 2026
Spanish technology retailer **PcComponentes** denied claims that attackers stole a customer database affecting roughly **16 million** users after a threat actor, **“daghetiaw,”** alleged theft of **16.3 million** records, leaked a sample (reported as **~500,000** records), and offered the remainder for sale. The allegedly exposed data was described as including customer PII and commerce/support artifacts such as names, physical addresses, phone numbers, IP addresses, order details, wish-lists, and customer support messages (including exchanges via *Zendesk*). PcComponentes stated its investigation found **no evidence of unauthorized access** to its databases or internal systems and disputed the claimed scale, noting the number of active accounts is significantly lower; it also said it does not store customer passwords or financial details. PcComponentes confirmed it experienced a **credential stuffing** attack, in which attackers attempt logins using reused email/password pairs sourced from other breaches. Threat intelligence firm **Hudson Rock** assessed the credentials likely originated from endpoints infected with **info-stealing malware**, aligning with the credential-reuse pattern. In response, PcComponentes implemented additional controls including **CAPTCHA** on login pages, **mandatory 2FA** for all accounts, and **session invalidation** requiring users to re-authenticate and enable 2FA.
Jun 29, 2026
Ledger disclosed that customer information was exposed after an incident involving **Global-e**, a third-party e-commerce partner used for order processing. Reporting from *The Register* and *CoinDesk* said the breach affected Ledger customer order data rather than wallet seed phrases or private keys, but still exposed personally identifiable information tied to purchases, raising renewed phishing, social-engineering, and physical-security concerns for hardware wallet owners. Ledger later published support advisories and an FAQ describing the **Global-e incident** and the resulting **e-commerce and marketing data breach**, including guidance on recognizing legitimate Ledger email addresses and avoiding scams. The company linked the event to order-data exposure and framed it separately from the firm’s widely known **2020 e-commerce data breach**, while warning customers to remain alert for fraudulent messages that misuse leaked contact or purchase details.
Jul 12, 2026