Valve has warned European customers who ordered Steam hardware that a breach at CEVA Logistics, which ran from July 29 to August 1, 2026, exposed delivery contact details linked to some orders. The company says the leaked information did not include payment card numbers, Steam passwords, or Steam Guard codes.
The warning applies to people who bought Steam hardware in Europe, including devices like the Steam Controller or Steam Machine, in the roughly 90 days leading up to the July 29 to August 1 breach. That lines up with CEVA Logistics’ data-retention window. Valve says it found out about the incident on August 7 and has started notifying affected users.
What was exposed is the kind of information that can make scam messages look real: full names, home addresses, phone numbers, and email addresses. With that, a phishing email, text, or phone call about a shipment, a refund, or an account issue can sound a lot more believable than it should.
Valve says Steam passwords payment card details, Steam passwords, and Steam Guard codes weren’t part of the breach, so most people shouldn’t need to rush into resetting their password or canceling a card.
Still, if you ordered Steam hardware in Europe recently, this is a notice to take seriously. Be careful with any unexpected message about a delivery or your account, especially if it asks you to click a link or hand over personal information.
Valve also says the broader attack hit eight CEVA Logistics warehouses in Europe. Other victims include Dutch companies such as Bol, de Bijenkorf, AFC Ajax, ING Bank, and Ace & Tate. The case is now being investigated by the Dutch Data Protection Authority, and Valve says it’s cooperating while also notifying other European regulators. If you may be affected, check the email address tied to your Steam account for Valve’s notice.
