Valve's notification is notable for what it contains and what it does not: payment information, Steam account credentials, and passwords were not compromised. But the exposed data is highly valuable for social engineering and phishing campaigns, and Valve explicitly warned customers to be on guard .

When and How the Breach Happened

The cyberattack on CEVA Logistics' systems occurred between July 29 and August 1, 2026 . Valve learned of the compromise on August 7, 2026 and immediately began contacting affected customers who had purchased Steam hardware — including the Steam Deck, Steam Machine, and Steam Controller — for delivery in Europe .

CEVA Logistics, a global shipping and logistics company, retained customer delivery information for up to 90 days after an order was placed. This means any European customer who ordered Steam hardware from approximately late April 2026 onward fell within the exposure window .

What Customer Data Was Compromised

According to Valve's security notification, the attackers likely accessed CEVA's servers and stole the following categories of information for affected hardware orders :

• Full names
• Home addresses (shipping addresses, including street, postal code, city, and country)
• Phone numbers
• Email addresses
• Order details, including the type of hardware purchased and the purchase price

What Was NOT Affected

Valve explicitly stated that the breach did not expose the following, which it never shares with shipping partners :

• Payment information — credit card numbers, bank account details, or other financial data
• Steam account credentials — passwords, Steam Guard codes, or two-factor authentication data
• Digital library information — game purchases, play history, or account settings

Valve told affected customers there was no need to change passwords or account settings as a result of this incident .

Broader Supply Chain Attack

The CEVA Logistics breach was not limited to Valve. According to reporting from TechCrunch, the same cyberattack also impacted multiple European retailers and banks that relied on CEVA for logistics services . CEVA is a global shipping and logistics giant, and the incident is described as a ripple-effect supply chain attack affecting organizations across several sectors .

Phishing Guidance for Affected Customers

Valve's notification included specific warnings about the risk of follow-on phishing attacks. The stolen data — names, addresses, phone numbers, email addresses, and order details — gives attackers everything they need to craft convincing scam messages that appear to come from Valve, a delivery company, or another trusted entity .

Valve advised customers to take the following precautions :

• Be vigilant against phishing emails, phone calls, or text messages from anyone claiming to be Valve or related to the incident
• Remember that Valve will never ask for sensitive information — such as passwords, payment details, or Steam Guard codes — via email, phone, or text
• Treat any unsolicited communications referencing the breach as potentially fraudulent
• Do not click on links or open attachments from unknown or unexpected senders

How to Protect Yourself If You May Be Affected

If you purchased Steam hardware for delivery in Europe between late April and early August 2026, your information may be in the hands of attackers. Beyond following Valve's phishing guidance, security experts recommend:

• Enabling two-factor authentication on your Steam account (which remains unaffected by this breach but is good general practice)
• Monitoring for suspicious SMS messages or phone calls that reference your Steam hardware order
• Reporting any suspected phishing attempts that impersonate Valve or CEVA to the appropriate authorities

The full scope of the breach is still under investigation by CEVA's cybersecurity team . Valve has said it will continue to update affected customers as more information becomes available .

Valve's notification is notable for what it contains and what it does not: payment information, Steam account credentials, and passwords were not compromised. But the exposed data is highly valuable for social engineering and phishing campaigns, and Valve explicitly warned customers to be on guard .

When and How the Breach Happened

The cyberattack on CEVA Logistics' systems occurred between July 29 and August 1, 2026 . Valve learned of the compromise on August 7, 2026 and immediately began contacting affected customers who had purchased Steam hardware — including the Steam Deck, Steam Machine, and Steam Controller — for delivery in Europe .

CEVA Logistics, a global shipping and logistics company, retained customer delivery information for up to 90 days after an order was placed. This means any European customer who ordered Steam hardware from approximately late April 2026 onward fell within the exposure window .

What Customer Data Was Compromised

According to Valve's security notification, the attackers likely accessed CEVA's servers and stole the following categories of information for affected hardware orders :

• Full names
• Home addresses (shipping addresses, including street, postal code, city, and country)
• Phone numbers
• Email addresses
• Order details, including the type of hardware purchased and the purchase price

What Was NOT Affected

Valve explicitly stated that the breach did not expose the following, which it never shares with shipping partners :

• Payment information — credit card numbers, bank account details, or other financial data
• Steam account credentials — passwords, Steam Guard codes, or two-factor authentication data
• Digital library information — game purchases, play history, or account settings

Valve told affected customers there was no need to change passwords or account settings as a result of this incident .

Broader Supply Chain Attack

The CEVA Logistics breach was not limited to Valve. According to reporting from TechCrunch, the same cyberattack also impacted multiple European retailers and banks that relied on CEVA for logistics services . CEVA is a global shipping and logistics giant, and the incident is described as a ripple-effect supply chain attack affecting organizations across several sectors .

Phishing Guidance for Affected Customers

Valve's notification included specific warnings about the risk of follow-on phishing attacks. The stolen data — names, addresses, phone numbers, email addresses, and order details — gives attackers everything they need to craft convincing scam messages that appear to come from Valve, a delivery company, or another trusted entity .

Valve advised customers to take the following precautions :

• Be vigilant against phishing emails, phone calls, or text messages from anyone claiming to be Valve or related to the incident
• Remember that Valve will never ask for sensitive information — such as passwords, payment details, or Steam Guard codes — via email, phone, or text
• Treat any unsolicited communications referencing the breach as potentially fraudulent
• Do not click on links or open attachments from unknown or unexpected senders

How to Protect Yourself If You May Be Affected

If you purchased Steam hardware for delivery in Europe between late April and early August 2026, your information may be in the hands of attackers. Beyond following Valve's phishing guidance, security experts recommend:

• Enabling two-factor authentication on your Steam account (which remains unaffected by this breach but is good general practice)
• Monitoring for suspicious SMS messages or phone calls that reference your Steam hardware order
• Reporting any suspected phishing attempts that impersonate Valve or CEVA to the appropriate authorities

The full scope of the breach is still under investigation by CEVA's cybersecurity team . Valve has said it will continue to update affected customers as more information becomes available .