If you live in Europe and have purchased hardware from Valve recently, there's a good chance your shipping information has been compromised. CEVA Logistics, who are responsible for shipping Valve's hardware in Europe, has been hit with a cyberattack between July 29th and August 1st. The company keeps shipping information on hand for up to 90 days, so anyone who made a purchase before and during the attack (and possibly after) likely has had their information compromised.
The type of information the attackers took includes name, address, postal code, city, country, phone number, and e-mail address (same one as the Steam one). Valve doesn't share passwords with CEVA, so your account should be safe, but be weary of any e-mails, regular mails or phone messages you might receive, as they're likely to be scammed. If you haven't ordered any hardware, you should be fine, but be cautious all the same. Those affected should have gotten an email similar to the quote below.
The number of people affected would likely be higher than normal, since plenty of people have just ordered the Steam Controller and Steam Machine recently. If you've only clicked to reserve the hardware itself, you should be fine, as you wouldn't have entered these details until you would purchase the hardware. Everyone else, stay safe out there and, once more, watch out for scams in the near future.
Quote From Email I received from Vavle Hello ,
Between July 29 2026 and August 1, 2026, a cyberattack hit CEVA Logistics, the company that ships Steam hardware to customers in Europe. CEVA is still investigating this attack, but as Valve learned on August 7, certain information about Steam customers, including you, was likely compromised.
CEVA receives specific delivery-related information from Steam to be able to ship physical hardware to customers in Europe, and told us these are the details the attacker likely took. Because CEVA retains this information for up to 90 days after that order, we are sending this message to all customers we can assume were impacted.
For you, that means the following information related to your hardware purchase may have been compromised:
your name
your street address, postal code and city
your country
your phone number
your email address — the same one your Steam account uses
the type and price of the ordered product
Additional information related to your Steam account or other purchases was not impacted. CEVA does not have access to your payment information, passwords, Steam Guard codes or other information.
What this means for you
Expect fake messages - email, SMS or phone - that mention your hardware order and appear to come from Steam, Valve or a delivery company. They may quote your address back to you to prove they're genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to “verify” your order. Treat all of them as fake.
You do not need to change your Steam password, and you don't need to do anything to your account settings.
Three things that are always true
Steam Support only handles account issues at https://help.steampowered.com/. Never by email, Steam Chat or Discord. Anyone who contacts you elsewhere claiming to be Steam Support is not.
Every real Steam login page is on store.steampowered.com, www.steampowered.com, steamcommunity.com or help.steampowered.com. Type the address yourself rather than following a link someone sent you.
Steam Support will never ask you for your password or a Steam Guard code. Neither will a courier.
What we're doing
We're pressing CEVA for the full scope of what was taken and how, and we are in the process of notifying the data protection authorities in the countries affected, including yours. CEVA has isolated the affected systems, taken all offline and brought in outside investigators.
If you have questions about this incident, the quickest way to reach us is our support site at help.steampowered.com. You can also write to the contact point we have designated for further information about this incident: Artana Digital GmbH, Alstertwiete 3, 20099 Hamburg, Germany.
Have you gotten the e-mail from Valve? Are you affected by this breach? Let us know in the comment below!
Leave a Comment