Valve Warns Customers After Cyberattack at European Shipping Partner

The hardware manufacturer Valve Corporation is notifying customers in Europe that their personal data may have been compromised following a cyberattack on its shipping partner, CEVA Logistics. The breach occurred between July 29 and August 1, 2026, though Valve did not learn of the incident until August 7.

Compromised information includes names, street addresses, phone numbers, email addresses, and order details for users who purchased hardware—such as the Steam Deck, Steam Machine, or Steam Controller—within a 90-day window. Valve confirmed that payment information, passwords, and Steam Guard codes were not affected, meaning no password changes are necessary.

Valve warned users to be vigilant against phishing attempts via email, SMS, or phone calls. Attackers may use the stolen address information to appear genuine while requesting customs fees or delivery confirmations. The company stated that any such requests should be treated as fraudulent.

CEVA Logistics has isolated the affected servers and is working with third-party investigators. Valve is currently pressing the logistics firm for the full scope of the breach and is notifying data protection authorities across the affected European countries.