Valve Warns European Steam Hardware Buyers After Breach at Shipping Partner CEVA Logistics

Valve has notified European customers who ordered Steam hardware that their personal information may have been exposed in a data breach at its shipping partner, CEVA Logistics. The company said it learned on August 7, 2026 that customer data was likely compromised in the incident, which occurred between July 29 and August 1. VideoCardz

The breach may have included customer names, addresses, phone numbers, and email addresses, according to Valve. The exposure stems from CEVA's practice of keeping delivery-related information for up to 90 days after orders are fulfilled, meaning the affected dataset covers a window of recent European hardware shipments. The Verge

Valve has moved quickly to draw a perimeter around what was and was not exposed. Payment information, passwords, and Steam Guard codes were not impacted, because CEVA does not have access to those systems. Additional data linked to users' Steam accounts or purchases was also unaffected. The breach was confined to the logistics layer — the shipping company's systems — not Valve's own infrastructure.

The more immediate concern Valve is flagging is social engineering. With names, addresses, phone numbers, and email addresses potentially in the hands of attackers, the combination is a ready-made kit for targeted phishing campaigns. Phishing is when attackers impersonate a trusted organization to trick you into revealing sensitive information or clicking malicious links. Valve warned customers to treat as fake any messages over email, text, or phone claiming to come from Steam, Valve, or a delivery company that quote addresses or ask to confirm a delivery, pay customs or redelivery fees, or sign in to verify an order. The specificity of the guidance — naming particular pretexts like customs fees and redelivery charges — signals that Valve considers weaponized impersonation the most likely follow-on threat.

Valve also reiterated that it only handles account issues through help.steampowered.com and will not contact users over email, Steam chat, or Discord. That is a useful boundary for customers to internalize. If a communication arrives through any other channel referencing a hardware order, the default assumption should be that it is fraudulent.

For security teams and platform operators, the incident is a concrete example of a familiar risk: a third-party vendor with a narrow, well-scoped data footprint still creating an exposure surface that reaches end users. CEVA held no payment data, no credentials, no authentication tokens. The dataset was logistics-only. Yet shipping metadata — name plus physical address plus phone number plus email — is precisely the combination that makes tailored phishing campaigns credible. An attacker who knows a target ordered hardware and can quote a real delivery address has already cleared the credibility bar that mass phishing never crosses.

The 90-day retention window is worth noting as an operational detail. Valve did not say how many customers fall within that window, nor has CEVA disclosed the scope of the breach beyond the dates. But the retention policy itself is a data-minimization question worth asking. Ninety days of delivery records is a standard logistics practice that supports returns and customer service follow-up. It is also, as this incident illustrates, a window during which a breach at the logistics partner creates a live exposure for the platform's customers.

Valve's communication has been direct. The company has not minimized the incident, has specified the data categories at risk, has drawn a clear line around what was not affected, and has given customers actionable guidance on what to watch for. That is a reasonable template for how a platform should respond when a partner's breach touches its users.

The absence of payment or credential exposure limits the blast radius of this incident. The realistic harm vector is phishing, and Valve has named it explicitly. Customers who ordered Steam hardware delivered in Europe within the relevant window should treat any unsolicited contact about their order with heightened suspicion, verify through help.steampowered.com, and avoid clicking links or providing additional information through any other channel.