Steam Machine and Controller buyers warned after CEVA Logistics cyberattack
Valve has started notifying European Steam hardware customers about a cyberattack at CEVA Logistics, the company handling Steam hardware shipments in the region. The attack took place between July 29 and August 1, 2026, while Valve says it learned on August 7 that customer information was likely compromised.
CEVA receives customer information required to deliver physical Steam hardware. Valve says the logistics company retains these records for up to 90 days after an order, so notices are being sent to customers whose information may have been stored during the affected period. Reports from users show that both Steam Machine and Steam Controller customers have received the warning.
Names, addresses and Steam account emails may have leaked
Valve says the following information related to hardware purchases may have been compromised:
- Name
- Street address, postal code and city
- Country
- Phone number
- Email address, including the same address used for the Steam account
- Type and price of the ordered product
© Steam/Reddit Valve says CEVA did not have access to payment information, Steam passwords or Steam Guard codes. Other Steam account information and unrelated purchases were also not affected. Valve therefore says users do not need to change their Steam password or account settings because of this incident.
Valve warns about targeted Steam and delivery scams
The exposed information does allow attackers to create convincing phishing attempts. Valve specifically warns customers about emails, SMS messages and calls mentioning their hardware order or address. Attackers could impersonate Valve, Steam or a delivery company and request a customs fee, redelivery payment or account login.
Valve says it is pressing CEVA for details about what data was taken and how the breach occurred. CEVA has isolated the affected systems and brought in outside investigators, while Valve is notifying data protection authorities in affected countries. The exact number of customers affected has not been disclosed.
Source: Reddit
