gaming

Valve notifies European Steam hardware buyers after CEVA Logistics cyberattack

Valve contacted customers who bought Steam hardware in Europe after regional shipping partner CEVA Logistics suffered a cyberattack between July 29 and August 1, 2026. The breach likely exposed delivery-related customer data that CEVA retains for up to 90 days, including names, street addresses, phone numbers, email addresses and order details. Valve learned of the incident on August 7, assembled a list of at-risk customers and warned recipients to watch for phishing that may use the compromised delivery data. CEVA’s attack affected eight warehouse hubs and caused shipping delays across Europe; no customer payment information or unrelated Steam account details were shared with CEVA and users do not need to change their Steam passwords.

• Attack window: July 29–August 1, 2026; Valve became aware on August 7 and began notifying impacted customers.
• Exposed data may include names, street addresses, phone numbers, email addresses and order details that CEVA retains for up to 90 days.
• CEVA’s breach affected eight warehouse hubs and disrupted shipping across Europe for its retail partners.
• Valve states payment information and non-delivery Steam account data were not provided to the shipping partner; customers should be vigilant for phishing using the compromised delivery details.