Valve warns European Steam hardware customers of likely data breach

Valve has notified European customers that personal data tied to their Steam hardware orders was likely compromised in a cyberattack on its logistics partner.

CEVA Logistics suffered a breach between July 29 and August 1. Valve learned of the incident on August 7 and determined that some customer information held by the shipping company was likely exposed. The gaming giant sent emails directly to affected Steam hardware owners in Europe detailing the exposure.

The compromised data includes names, addresses, phone numbers, email addresses and order details. CEVA Logistics does not hold payment information, Steam passwords, Steam Guard codes or other sensitive account credentials. Valve has stated that affected users do not need to change their Steam passwords or account details.

Scam messages targeting hardware orders are expected. Valve warned that customers should watch for fake emails, SMS messages or phone calls that reference their specific hardware order and appear to come from Steam, Valve or a delivery company. These messages may attempt to trick recipients into paying a small customs or redelivery fee or signing into a site to verify the order by leveraging stolen details such as addresses.

The company is pressing CEVA Logistics for the full scope of what was taken and how the breach occurred. Valve is also in the process of notifying data protection authorities in the affected countries.

European Steam hardware owners are advised to remain vigilant. The breach is limited to customers who received Steam hardware shipments through the affected logistics provider. No broader Steam platform accounts or financial data appear to have been impacted according to Valve's disclosure.