Valve notifies Steam hardware customers of a data breach

Video game publisher and digital distribution giant Valve is notifying Steam hardware customers across Europe about a cybersecurity incident that exposed personal customer information following a breach at its regional logistics provider. According to a BleepingComputer's report, attackers compromised servers belonging to CEVA Logistics, the third-party partner responsible for handling physical hardware deliveries for Steam orders in European territories.

This article details the scope of the unauthorized access, the specific types of customer records affected, and the security recommendations issued to impacted individuals. It also examines how the breach occurred within CEVA Logistics' IT infrastructure and outlines the current state of investigations by external cybersecurity specialists and European data protection authorities.

What broke in Valve notifies Steam hardware customers

A cyberattack hit CEVA Logistics between July 29, 2026, and August 1, 2026, targeting systems used to fulfill European Steam hardware shipments. Valve learned of the security incident on August 7, 2026, after CEVA Logistics determined that delivery-related customer records were likely compromised. CEVA Logistics retains shipment information for up to 90 days following order completion, which expanded the window of exposure to include customer orders fulfilled during that period.

The security breach at CEVA Logistics forced the shipping carrier to isolate affected systems, take compromised infrastructure offline, and bring in third-party forensic investigators. The operational disruption impacted eight of CEVA Logistics' European warehouses, with the company notifying multiple European retailers about the incident on August 1, 2026. CEVA Logistics is a fully-owned subsidiary of the CMA CGM Group—the world's third-largest shipping company—operating 1,000 warehouses, handling 15 million shipments, and reporting $18.3 billion in revenues in 2025.

Who is exposed by Valve notifies Steam hardware customers

The compromised records belong to Steam customers in Europe who ordered physical hardware shipped through CEVA Logistics during the retention window. The exposed data includes customer names, delivery addresses, phone numbers, email addresses, and the specific types and prices of ordered products. Valve began distributing data breach notification emails directly to impacted European customers following confirmation from the logistics vendor.

Valve confirmed that core Steam account credentials and financial records were not involved in the incident. Because CEVA Logistics only receives operational logistics details, the attackers did not gain access to payment information, passwords, Steam Guard authentication codes, or broader Steam account transaction histories. No additional account settings or internal Steam security infrastructure were compromised by the breach.

What to do now about Valve notifies Steam hardware customers

Valve instructed affected customers to monitor incoming communications for targeted email, SMS, or voice phishing campaigns that leverage the stolen order details. Attackers may quote accurate physical addresses, order types, or pricing details to fabricate authenticity, demanding redelivery fees, customs payments, or order verification actions. Valve explicitly advised recipients to treat all suspicious messages claiming to represent Steam, Valve, or delivery services as fraudulent.

Affected users do not need to reset their Steam account passwords, update credentials, or modify internal account security settings. Valve noted that legitimate delivery updates will not require users to sign in to third-party verification portals or submit additional payments for existing orders. Customers are advised to verify any shipping inquiries directly through official Steam support channels rather than clicking links embedded in unsolicited messages.

How the Valve notifies Steam hardware customers issue works

The incident originated from unauthorized access to CEVA Logistics' internal servers during a three-day window spanning late July and early August 2026. As part of standard fulfillment protocols, Valve supplies CEVA Logistics with specific delivery data necessary to process and transport physical hardware across Europe. The intruder accessed these specific logistics databases where order records are stored for operational processing and temporary record-keeping.

Upon detecting unauthorized activity on August 1, 2026, CEVA Logistics initiated containment protocols by isolating infected server segments and shutting down network access across affected facilities. Valve was formally alerted to the potential data exposure on August 7, 2026. Valve is pressing CEVA Logistics for a complete analysis of the intrusion vectors and is filing disclosures with relevant national data protection regulatory bodies across the impacted European jurisdictions.

What is still unknown about Valve notifies Steam hardware customers

The total count of affected European Steam customers has not been publicly released by Valve or CEVA Logistics. Forensic teams continue to analyze server logs to establish the exact mechanism of entry and confirm whether data was exfiltrated or merely accessed during the three-day intrusion window. The identity of the cybercrime group or threat actor responsible for the attack remains undisclosed.

Investigations into the full operational impact across CEVA Logistics' wider client network are ongoing as outside investigators examine system logs. Valve has not specified which individual European countries have the highest concentration of affected hardware buyers. A Valve spokesperson was not immediately available for additional comment when contacted regarding the incident.