Valve says data of 35,000 Steam hardware buyers likely stolen

Valve warned European customers that their personal data was likely exposed after a cyberattack on CEVA Logistics, the company responsible for shipping Steam hardware products.

The breach occurred between July 29 and August 1, and Valve confirmed on August 7 that some customer information had been compromised. CEVA Logistics handles deliveries for Steam hardware orders in Europe, and while the hackers accessed names, addresses, phone numbers, emails, and order details, they did not get payment details, passwords, or Steam Guard codes. Valve stressed that customers don’t need to change their Steam account passwords or security settings.

The exposed information could make customers targets for scams, with Valve warning of fake emails, texts, or calls pretending to be from Steam, Valve, or delivery companies. These messages may reference real order details to trick victims into paying small fees or entering login credentials. Valve is pushing CEVA for a full investigation and has started reporting the breach to data protection authorities in affected countries.

This incident highlights growing risks in supply chain cyberattacks, where hackers target third-party vendors to access customer data. While no financial or highly sensitive data was stolen, the breach still puts users at risk of phishing and fraud. Valve’s response—urging caution and working with regulators—shows how companies handle fallout from supply chain breaches. Customers should stay alert for suspicious messages and verify any unexpected communications directly with Steam.