Valve has issued a warning to certain European customers after a cyberattack on CEVA Logistics, the company that handles Steam hardware distribution across the continent. Personal information belonging to people who recently purchased a Steam Machine or Steam Controller may have been exposed in the breach.
CEVA notified Valve of the incident on August 7. The attack itself occurred between July 29 and August 1. According to Valve, the data that may have been accessed includes real names, postal addresses, country information, phone numbers, and email addresses. Importantly, Steam account credentials, passwords, and payment details were not part of the compromised information. CEVA does not have access to those systems, so the core Steam accounts of affected users remain secure.
Valve is contacting customers in Europe who purchased Steam hardware within the 90-day window surrounding the attack. Those users should receive an email from Valve outlining the situation. The company is also urging anyone in the affected group to stay alert for follow-up scam attempts. Fraudsters who obtain names, addresses, phone numbers, and email addresses often use that information to craft convincing messages that appear to come from Steam, Valve, or a shipping partner.
Typical scams in this situation claim there is a problem with a hardware order and ask the recipient to pay a fee, click a link, or log in to a fake website to "verify" the purchase. Valve has stated clearly that it will not ask customers to pay additional fees or sign in through unsolicited messages related to these orders. Any such contact should be treated as fraudulent and ignored.
The breach affects only the logistics side of Steam hardware fulfillment in Europe. Players who have never ordered a Steam Machine or Steam Controller through the channels handled by CEVA are not part of this incident. Even among hardware buyers, the exposure is limited to shipping and contact details rather than account or financial data.
Steam hardware has become a more visible part of Valve’s business in recent years. The Steam Deck established a large installed base, and the Steam Machine has drawn attention despite a high starting price influenced by the ongoing memory shortage. Demand for the devices has remained strong enough that logistics partners like CEVA handle regular shipments across multiple countries. That volume is what made the customer data valuable to the attackers.
Cyberattacks on logistics and fulfillment companies have become a recurring risk for any hardware business. These firms necessarily hold names, addresses, and contact details in order to ship products. When one of them is breached, the hardware seller is left notifying customers about data it did not directly control. Valve’s response follows the standard pattern: confirm the scope, state what was and was not exposed, warn about likely phishing follow-ups, and advise users on how to respond.
For affected customers, the practical steps are straightforward. Watch for the official email from Valve. Treat any unexpected message about a Steam hardware order with suspicion, especially if it asks for money or login credentials. Consider enabling stronger authentication options on the Steam account as a general precaution, even though passwords were not part of this breach. Monitor email and phone contacts for unusual activity in the coming weeks.
Valve has not published a precise number of affected customers. The company limited its public statement to the nature of the data, the time frame of the attack, and the guidance for users who may be involved. Until more details emerge from either Valve or CEVA, the only confirmed facts are those shared in the August 10 warning.
The incident does not appear to have disrupted Steam’s digital storefront or existing hardware support channels. It is confined to the personal information held by a European logistics partner. Still, for anyone who recently ordered a Steam Machine or Steam Controller and lives in the affected region, the breach is a reminder that shipping data carries its own risks. Valve’s message is clear: the core Steam account is safe, but the contact details tied to recent hardware orders may now be in someone else’s hands, and scam attempts are likely to follow. So be on your guard and wary of scammers.