A data breach at a third-party logistics provider may have exposed personal details belonging to European customers who purchased Steam hardware. Valve confirmed the incident in an email notification, warning affected users that names, home addresses, phone numbers, and email addresses could be involved.
The security lapse hit CEVA Logistics, Valve’s European shipping partner, between July 29th and August 1st. This window came shortly after Valve opened reservations for its new Steam Machine and began shipping the Steam Controller. CEVA retains delivery-related records for up to 90 days following an order, which means European buyer information “was likely compromised” during the incident.
Valve now cautions customers to brace for phishing attempts. Fraudsters may reach out through email, SMS, or phone calls while posing as Steam, Valve, or a delivery company. These scams could include quoting your address back to establish legitimacy. Attackers might then request delivery confirmation, demand a small customs or redelivery payment, or direct victims to a fake sign-in page under the guise of order verification.
The company’s guidance remains blunt: treat every such message as fraudulent.
Meanwhile, Valve emphasized that no Steam account credentials, purchase history, or payment data fell into the wrong hands. CEVA never had access to passwords, Steam Guard codes, or financial information. Support requests only originate from support.steampowered.com. Valve will never contact users through email, Steam chat, or Discord.
The breach underscores a growing challenge for hardware manufacturers relying on external fulfillment partners. As gaming hardware demand rises across Europe, shipping vendors increasingly become prime targets for cybercriminals seeking customer data.
Valve has not disclosed the total number of affected customers. The company continues investigating the scope of the incident alongside CEVA Logistics.
