Valve Warns Steam Hardware Buyers After CEVA Logistics Data Breach Exposes Customer Details
Valve is warning Steam hardware customers in Europe after a cyberattack at shipping partner CEVA Logistics likely exposed names, home addresses, phone numbers, email addresses, and details about the hardware they ordered.
The breach didn’t hand over Steam passwords or payment data, but it may have given scammers something almost as useful: enough real-world order information to make a fake delivery message look uncomfortably convincing.
➜ The real story: This is the kind of breach that turns boring shipping data into premium phishing fuel. Your Steam account may be fine, but a scammer knowing what you bought, what it cost, and where it was headed is exactly how a sketchy “redelivery fee” text starts looking legit.
Valve says the CEVA cyberattack ran from July 29 through August 1, and Valve learned on August 7 that customer information had likely been taken. CEVA keeps delivery-related Steam customer data for up to 90 days, so Valve is notifying customers it believes may have been caught in that window.
What the CEVA Logistics Data Breach Exposed for Steam Customers
The compromised information may include a customer’s name, street address, postal code, city, country, phone number, email address, and the type and price of the Steam hardware ordered.
That’s a pretty specific snapshot of a real purchase, which is why this matters even without financial credentials in the mix.
Valve says CEVA did not have access to payment information, Steam passwords, or Steam Guard codes, and additional Steam account data wasn’t affected. In other words, this is a personal-data problem more than an account-takeover problem.
Why Valve Says Steam Hardware Buyers Should Expect Phishing Scams
Valve is telling affected customers to “expect fake messages” by email, SMS, or phone that may pretend to come from Steam, Valve, or a delivery company.
The obvious play is a message about customs, redelivery, or order verification, except the scammer may be able to quote a real address or hardware order to make the pitch feel credible.
Valve says customers do not need to change their Steam passwords because those credentials were not part of the CEVA data.
The smarter move is to avoid links in unexpected delivery messages and go directly to Steam or the delivery service yourself.
The CEVA Logistics Cyberattack Is Bigger Than Steam
Steam customers are only one piece of a much wider incident.
CEVA says the operational impact is limited to eight European warehouses, while companies including Dutch retailer Bol, luxury department store de Bijenkorf, Ajax, ING, and eyewear brand Ace & Tate have also reported customer or shipping-data fallout tied to the breach.
Some retailers have warned about delayed or canceled orders as systems recover.
That broader ripple is the reminder here: the company delivering your stuff can hold enough personal data to become part of your security perimeter, even if you never think of it that way.
FAQs
Here’s what Steam hardware customers need to know about the CEVA Logistics data breach and the phishing risk that follows it.
What Steam customer data was exposed in the CEVA Logistics breach?
Valve says names, addresses, phone numbers, email addresses, country information, and the type and price of ordered Steam hardware may have been compromised.
Do I need to change my Steam password after the CEVA data breach?
Valve says no. CEVA did not have access to Steam passwords, Steam Guard codes, or payment information, so changing account credentials is not required because of this incident.
What scams should Steam hardware customers watch for?
Watch for fake delivery, customs, redelivery, or order-verification messages that mention real purchase details. Avoid embedded links and navigate directly to the official service instead.
