A cyberattack targeted CEVA Logistics, the shipping partner responsible for delivering Steam hardware to customers in Europe, between July 29 and August 1, 2026. The attackers gained unauthorized access to CEVA's servers, compromising delivery-related customer data including names, addresses, phone numbers, email addresses, and product order details. Valve confirmed that no Steam account credentials, payment data, passwords, or Steam Guard codes were accessed, as CEVA does not have access to such information. Valve is notifying affected customers and data protection authorities and has urged caution against phishing attempts that may use the stolen information to impersonate Valve or delivery services. CEVA has taken affected systems offline and is conducting an investigation with external experts.

The breach exposed personal identifying information and order details of Steam hardware customers in Europe, potentially enabling targeted phishing attacks. However, no sensitive Steam account credentials or payment information were compromised, limiting the scope of direct financial or account access risks. Customers may face increased phishing attempts via email, SMS, or voice calls impersonating Valve or delivery companies using stolen data to appear legitimate.

Valve has informed affected customers and data protection authorities and is coordinating with CEVA Logistics, which has isolated compromised systems and engaged external investigators. Customers are advised to be vigilant against phishing attempts that may reference their delivery information and to treat any such communications as fraudulent. Valve confirmed no action is required regarding Steam account credentials or passwords. Organizations should monitor communications for phishing and educate users accordingly.