Steam hardware distributor hit by cyberattack, 'expect fake messages,' Valve warns — Europe vendor has personal information and hardware purchase details stolen

European Steam hardware customers should anticipate receiving fraudulent messages, such as emails, SMS, or phone calls, according to Valve, following an attack on its European hardware distributor, CEVA Logistics. The compromised data includes personal information and purchase details, though payment information, passwords, and Steam Guard codes remain secure.

The cyberattack occurred between July 29 and August 1, 2026, with Valve becoming aware on August 7. CEVA's breach exposes a list of Steam hardware customers' names, addresses, phone numbers, email addresses, and order specifics. The stolen information will be useful to the attackers for perpetrating phishing scams, requesting additional customs or delivery fees, and requesting account access via fake web portals.

Valve advises customers in Europe to remain vigilant against these deceptive communications, which may request additional fees or prompt users to sign into unfamiliar websites. Users should disregard such requests and refrain from changing their Steam passwords or account settings. Valve emphasizes that Steam Support will not request account details or Steam Guard codes and that couriers will never ask for such information.

Following the discovery of the hack, CEVA isolated the affected systems and reported the incident to data protection authorities.