CEVA Logistics, Valve’s European shipping partner for Steam hardware, suffered a cyberattack between July 29 and August 1, 2026, likely exposing personal customer data, Valve confirmed on August 10 [1, 2, 3, 4]. The incident affected at least eight CEVA warehouse hubs across Europe, causing shipment delays and order cancellations for some customers [5, 3, 4].

The compromised data may include customer names, addresses, phone numbers, email addresses linked to Steam accounts, countries of residence, and details of Steam hardware purchases, according to Valve and other sources [1, 6, 7, 8, 9, 2, 10, 3, 11, 4]. Valve emphasized that payment information, passwords, Steam Guard codes, and other sensitive Steam account credentials were not accessed in the breach [1, 6, 7, 8, 9, 10, 3, 11, 4]. "CEVA does not have access to your payment information, passwords, Steam Guard codes or other information," Valve said [10].

CEVA retains delivery-related customer information for up to 90 days after order fulfillment, meaning individuals who ordered hardware within that timeframe may have been affected [1, 8, 2, 10, 3]. Valve said it is alerting "all customers we can assume were impacted" [8].

Valve started notifying affected European customers on August 10 after learning of the breach on August 7 and assessing the scope [1, 6, 8, 2, 3, 4]. Earlier, some Dutch companies were informed of the attack on August 1 [2].

Valve warned against phishing scams targeting affected customers that use stolen personal information to appear legitimate. "Expect fake messages - email, SMS or phone - that mention your hardware order and appear to come from Steam, Valve or a delivery company," Valve said. "They may quote your address back to you to prove they’re genuine. Treat all of them as fake." [1]

Valve also cautioned that "Steam Support never contacts customers through email, Steam Chat, or Discord, and only handles account problems through its help page" [6].

CEVA is a France-headquartered global logistics company with $18.3 billion in 2025 revenue, operating many warehouses across Europe including at least eight impacted hubs [5, 3, 4]. Valve said it is pressing CEVA for a full accounting of the data taken and is notifying data protection authorities in affected countries [1, 8, 10, 3, 11, 4].

Steam Machines and Steam Controllers continue shipping in Europe, but Valve warned that new orders may face delays until 2027 [1, 8].