Quick Answer
Valve confirmed on August 10, 2026 that a cyberattack on its European shipping partner CEVA Logistics, running from July 29 to August 1, likely exposed Steam hardware buyers’ names, home addresses, phone numbers, email addresses, and order details. Passwords, payment data, and Steam Guard codes were not taken. Affected customers should treat any unexpected delivery or Steam message as a phishing attempt.
Key Takeaways
- The breach hit CEVA Logistics, not Steam or Valve’s own servers, between July 29 and August 1, 2026.
- Stolen data includes full names, street addresses, phone numbers, Steam-linked email addresses, and the type and price of hardware ordered.
- Steam passwords, Steam Guard codes, and payment card details were not exposed because CEVA never held that data.
- Valve warned customers to treat any email, SMS, or phone call referencing their address or order as a scam, even if the sender quotes accurate details back to them.
- The same CEVA breach has affected at least six other organizations across Europe, including Dutch retailer Bol, luxury department store De Bijenkorf, bank ING, and Amsterdam football club Ajax.
What exactly happened in the Steam CEVA Logistics breach?
Valve, the video game publisher and digital distribution giant behind Steam, is notifying Steam hardware customers in Europe that hackers stole their data after breaching its shipping partner, CEVA Logistics. The breach occurred between July 29 and August 1, 2026, and Valve says it learned of the compromise on August 7, prompting the company to notify all customers it believes were affected through a direct security email.
In these emails, Valve said the attackers had access to CEVA Logistics’ servers during that window, which allowed them to gain access to information needed to ship hardware orders to Steam customers in Europe. CEVA Logistics has confirmed that the cyber intrusion affected part of its European contract logistics operations, according to reporting on Valve’s customer notification. CEVA has isolated the affected systems, taken them all offline, and brought in outside investigators. Valve sent breach notification emails to affected buyers on August 10, 2026, and Valve says it is pressing CEVA for additional information on the scope and cause of the breach and is notifying the relevant data protection authorities in the affected European countries.
CEVA Logistics is the France-headquartered firm that ships Steam hardware, including Steam Machines, Steam Controllers, and Steam Deck units, to customers across Europe on Valve’s behalf. CEVA Logistics reported $18.3 billion in revenue last year and operates roughly 1,700 locations across 170 countries, serving clients well beyond Valve. The scale of CEVA’s operations explains why a single intrusion into its European warehousing systems produced such a wide blast radius across multiple industries and brands.
Which Steam hardware buyers are affected?
Valve has confirmed that the cyberattack on CEVA Logistics exposed customer data belonging to buyers of Steam hardware, including the Steam Deck, Steam Machine, and Steam Controller, across Europe. Because CEVA retains shipping information for up to 90 days after an order, Valve is sending notifications to all customers it can assume were impacted. In practical terms, that means any European customer who ordered Steam hardware in the roughly three months before August 1, 2026 should assume their data was in CEVA’s systems during the breach window.
The exact number of customers affected has not been disclosed. Valve’s notification covered buyers of multiple hardware products, and reports from users show that both Steam Machine and Steam Controller customers have received the warning alongside Steam Deck buyers. If you purchased Steam hardware as a European customer and have not received an email by now, check your spam folder, as Valve is contacting everyone it can identify within that 90-day window. There is no confirmed action a customer can take to verify their specific inclusion beyond waiting for Valve’s direct email.
What data was stolen, and what was not?
According to Valve’s disclosure, the attacker likely accessed delivery-related information that CEVA retains for up to 90 days after an order is placed, including the customer’s full name, street address, postal code, city, country, phone number, the email address linked to their Steam account, and details about the type and price of the hardware ordered.
Valve has stressed that no Steam account credentials, passwords, Steam Guard codes, or payment information were affected, since CEVA never had access to that data in the first place. This distinction matters practically: a criminal who holds the stolen data cannot log into your Steam account, charge your payment method, or bypass Steam Guard using only what was taken. That said, the combination of real name, home address, phone number, and specific purchase details is enough to run highly convincing follow-on attacks, which are the more immediate risk.
| Data Category | Stolen? | Risk to You |
|---|---|---|
| Full name | Yes | Enables personalized phishing messages |
| Street address, city, postal code, country | Yes | Makes fake delivery notices highly convincing |
| Phone number | Yes | Enables SMS and voice phishing (smishing/vishing) |
| Steam-linked email address | Yes | Enables targeted email phishing using known purchase context |
| Hardware type and price paid | Yes | Adds credibility to scam messages referencing your specific order |
| Steam password | No | Account login is not at risk from this breach alone |
| Steam Guard two-factor codes | No | Two-factor authentication remains intact |
| Payment card or bank details | No | Financial accounts are not at direct risk from this breach |
How wide is the CEVA breach beyond Steam?
The incident reportedly disrupted operations at eight warehouses in Europe, causing shipping delays for retailers whose inventory was stored at the affected facilities. Companies reported to have been affected include Dutch e-commerce giant Bol, luxury department store De Bijenkorf, eyewear company Ace & Tate, Amsterdam football club Ajax, and Steam’s hardware business in Europe. For ING, the hack involves customers who redeemed points from the bank’s loyalty program for a physical product. The bank said no payment data was leaked. Several of the affected organizations have also notified the Dutch Data Protection Authority, according to The Record’s coverage of affected CEVA customers, which reflects the fact that the incident involves personal information connected to European customers and order fulfillment.
The breach was not at the affected companies’ own systems, but at their shared delivery partner, which is why a single security incident has ended up touching so many different organizations at once. Dutch Brief reports that data associated with Bol and De Bijenkorf customers is already being offered on the dark web. This is a meaningful escalation: data appearing on the dark web signals that the stolen records are actively being prepared for criminal use, not merely held. Customers of all the affected organizations should be on alert for follow-on phishing attempts, not only Steam hardware buyers. Because the exposed information is directly relevant to users concerned about credential theft and account takeover techniques, treating any unsolicited contact as suspicious is the correct posture regardless of which company originally passed your data to CEVA.
The full scope of the breach remains unclear, including the locations of the eight affected warehouses. CEVA has not said who was behind the attack or whether the hackers demanded a ransom. This is not CEVA’s first brush with attackers. A threat group known as CoinbaseCartel claimed responsibility for a separate, more extensive CEVA breach discovered in September 2025, allegedly exfiltrating full database schemas covering client accounts, costs, VAT numbers, and financial data. It remains unclear whether the current incident is connected to that earlier compromise or represents a fresh intrusion.
What is the real phishing risk, and why does it matter?
Security researchers warn that the combination of real names, home addresses, phone numbers, and specific purchase details creates ideal conditions for highly convincing phishing and delivery-fraud campaigns, particularly given how easily generative AI tools can now personalize scam messages. The risk is not that a criminal can access your Steam account directly. The risk is that a follow-on message arrives appearing to come from Steam, Valve, or a courier and is compelling enough that you act on it.
Valve specifically warns customers about emails, SMS messages, and calls mentioning their hardware order or address. Attackers could impersonate Valve, Steam, or a delivery company and request a customs fee, redelivery payment, or account login. Valve’s own notification was explicit that a scammer “may quote your address back to you to prove they’re genuine,” may ask you to “confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to verify your order,” and all such messages should be treated as fake.
Readers who want to understand how vishing and social-engineering calls work in practice can find a detailed breakdown in TechJournal’s coverage of impersonation scams that use personal data to build credibility. The same psychological mechanics apply here: accurate personal details lower a target’s defenses. The practical response is to verify any message by navigating directly to store.steampowered.com or contacting Valve Support through the official site, never by clicking a link in an unexpected message.
What steps should affected Steam hardware buyers take right now?
- Do not click links in any unexpected email, SMS, or chat message referencing your Steam order or address. Navigate directly to your Steam account page if you want to check order status or account security.
- Enable Steam Guard two-factor authentication if you have not already done so. Open the Steam desktop client, go to Steam > Settings > Account, and turn on Steam Guard. Two-factor codes were not stolen in this breach, so Steam Guard remains a reliable layer of protection against account takeover attempts that may follow.
- Change your Steam account password as a precaution, even though passwords were not directly taken. Attackers may use stolen email addresses in credential-stuffing attempts against other services where you may reuse the same password.
- Watch for fake customs or redelivery fee requests. Legitimate shipping carriers and Valve do not ask for unexpected payments via text link to release a parcel. Treat any such request as fraudulent.
- Monitor your email address associated with your Steam account for unusual login attempts or password-reset requests at other services. Use a password manager and ensure each account has a unique password.
- Check breach-notification services such as Have I Been Pwned to see whether your email address appears in known data-sale listings as more information about the CEVA breach becomes public.
- Report phishing attempts to Valve through the Steam Support page and to your national consumer protection authority. In the US, that is the FTC at reportfraud.ftc.gov. European users should contact their national data protection authority.
Stop at step 7 and contact Valve Support directly if you see unauthorized purchases in your Steam account or suspect your account has already been compromised, because account recovery requires identity verification that only Valve’s team can process.
Why do logistics provider breaches keep exposing so many customers at once?
What initially appeared to affect customers connected to retailers such as Bol and De Bijenkorf has now expanded to include organizations such as Ajax, ING, and Ace & Tate, highlighting a difficult reality of modern digital commerce: a company does not need to be hacked directly to have its customers exposed. The affected retailers and organizations may have maintained their own security controls, yet information entrusted to a shared logistics provider could still become exposed through the provider’s infrastructure.
This is the supply-chain problem in its plainest form. The more businesses that depend on the same external provider, the greater the potential blast radius when that provider experiences a security incident. CEVA’s role as a centralized fulfillment partner for dozens of major European brands means that a single intrusion can produce simultaneous disclosure obligations across retail, banking, sports, and gaming. The same structural vulnerability that makes software supply-chain attacks so damaging in the developer ecosystem applies equally to physical logistics networks.
The logistics sector is an obvious choice for cybercriminals, argued Joseph Perry, cybersecurity researcher and advanced services lead at Arcova, because logistics firms “sit at the center of thousands of transactions between businesses and their customers.” For consumers, the consequence is that personal data shared with one trusted retailer can be exposed through a vendor several steps removed from the original purchase, with no action on the consumer’s part causing the exposure. The Cybersecurity and Infrastructure Security Agency (CISA) identifies supply-chain compromise as one of the most consequential threat categories facing organizations today, precisely because a single third-party failure cascades across every business that depends on it.
FAQ
Did Valve’s own Steam servers get hacked?
Valve’s own servers were not breached in this incident. The hack targeted CEVA Logistics, Valve’s European shipping partner, not Valve’s own infrastructure. Steam account data, including passwords, Steam Guard codes, and payment information, was not stored with CEVA and was therefore not accessible to the attackers.
How do I know if I am one of the affected Steam hardware buyers?
Valve began emailing data breach notifications to affected customers on August 10, 2026. Valve is contacting customers whose information may have been stored during the affected period, based on CEVA’s 90-day post-order data retention policy. Check the inbox and spam folder of the email address linked to your Steam account. If you ordered Steam hardware in Europe in the roughly three months before August 1, 2026, assume your data was present in CEVA’s systems.
Should I change my Steam password even though passwords were not stolen?
Changing your Steam password is a reasonable precaution. The stolen data includes names, addresses, phone numbers, and email addresses, which attackers can use to target you across other services where you may reuse the same password. Changing your Steam password and enabling Steam Guard two-factor authentication closes any residual risk from credential-stuffing attempts that may follow.
Could the stolen data be used to access my Steam account?
No Steam account credentials, passwords, Steam Guard codes, or payment information were affected, since CEVA never had access to that data in the first place. The stolen data cannot be used to log into a Steam account directly. The practical risk is targeted phishing: an attacker who knows your name, address, and what hardware you ordered can craft a convincing fake message designed to get you to hand over credentials or payment details voluntarily.
Is CEVA the only logistics company with this kind of customer data exposure risk?
CEVA Logistics is not unique in this respect. Any logistics company that processes delivery orders for multiple retail clients holds the same type of personal data across its entire client portfolio. The incident occurred inside CEVA Logistics’ environment, where customer and delivery information connected to multiple organizations was processed. This is a structural characteristic of centralized fulfillment, and it means that the vendor-risk problem exposed here applies broadly across e-commerce and consumer electronics retail, not only to gaming hardware purchases.