← Valve

2026 Valve / Steam hardware — CEVA Logistics EU shipping breach; names/addresses/phones/emails (Aug 10 notices)

2026 Unknown records affected Share on X

Data compromised

Names, addresses, phone numbers, email addresses, and type/price of ordered Steam hardware products for customers whose delivery data CEVA retained (up to 90 days). Valve states no Steam account passwords, payment information, Steam Guard codes, or other Steam account data were accessible to CEVA. Count unpublished.

Technical writeup

Company-confirmed third-party breach — On August 10, 2026 Valve began emailing European Steam hardware customers that a cyberattack on shipper CEVA Logistics between July 29 and August 1 likely compromised delivery-related information (names, addresses, phones, emails, product type and price). Valve learned of the exposure August 7; CEVA retains shipping data up to 90 days, so Valve is notifying all customers it assumes were impacted. Valve stressed Steam account credentials, payments and Steam Guard were not held by CEVA, advised not to change Steam passwords, and warned of phishing impersonating Steam/Valve/delivery firms. Valve said it is notifying affected DPAs. Part of the wider CEVA European warehouse wave also hitting Dutch retail and other brands. recordsAffected 0 pending an attested count. Customer notification emails continued circulating widely among European Steam hardware buyers through mid-August 2026 (community reports), consistent with Valve’s Aug 10 notification wave. No public headcount published as of Aug 13 update.

Root cause

Third-party breach at CEVA Logistics (Steam hardware shipper for Europe); Valve says attackers accessed CEVA servers July 29–August 1, 2026; Valve learned Aug 7 and began notifying customers Aug 10.

References

Breaches you may like