Valve Warns Steam Hardware Buyers of a Breach at Its Logistics Partner

Valve has begun sending European buyers of its hardware notifications about a leak of personal data. The cause was not a breach of Valve itself but an attack on its logistics partner — CEVA Logistics, the company that handles the delivery of physical Steam hardware to customers in Europe.

What happened

According to the notification, the attackers had access to CEVA Logistics' servers between July 29 and August 1, 2026. Valve learned of the incident on August 7. CEVA receives certain data from Steam that is needed to deliver orders and retains it for up to 90 days after the order is placed — which is why the notifications were sent to everyone who could be considered affected.

In all likelihood, the attackers obtained customers' names, addresses, phone numbers and email addresses, along with the type and cost of the items ordered. That said, Valve stresses that CEVA has no access to payment information, passwords, Steam Guard codes or other sensitive account data — none of that was affected.

A phishing warning

The main risk now is targeted phishing. Valve explicitly warns customers that they may be targeted via email, SMS or voice calls purporting to come from Steam, Valve itself or delivery services. Armed with a recipient's real address, scammers can cite it to build trust, then offer to “confirm delivery,” collect a small customs or redelivery fee, or have the victim “log in” somewhere to verify the order.

The company's advice is unequivocal: treat any such contact as fake. There is no need to change your Steam password or alter anything in your account settings — the accounts were not affected.

Scale and context

CEVA Logistics is a subsidiary of the CMA CGM group, the world's third-largest ocean carrier. The company operates a thousand warehouses, handled 15 million shipments over the past year, and reported revenue of $18.3 billion for 2025.

Valve's disclosure follows an earlier report: back on August 1, CEVA notified a number of European retailers of a cyberattack that had disrupted the operation of eight of its European warehouses. According to Valve, CEVA isolated the affected systems, took them offline, and brought in outside specialists to investigate. Valve, for its part, continues to determine the full extent of what was stolen and is notifying data protection authorities in the affected countries.

Source: Bleeping Computer