Valve confirms Steam hardware buyers' data exposed in CEVA Logistics cyberattack

Valve is informing European customers who purchased Steam hardware that their personal data may have been compromised due to a cyberattack on CEVA Logistics, the logistics firm responsible for Steam hardware deliveries in Europe. The breach, which took place between July 29 and August 1, was discovered on August 7. Valve learned of the incident and is notifying all potentially affected customers within the 90-day period that CEVA retains order information.

The exposed details include names, addresses, postal codes, cities, countries, phone numbers, Steam account email addresses, and the type and price of the hardware purchased. Valve maintains that no payment information, passwords, Steam Guard codes, or other account data were affected, and customers do not need to alter their passwords or account settings.

However, Valve has cautioned users to be wary of phishing attempts via email, SMS, or phone that reference their order, potentially including real addresses to seem authentic. Valve has urged customers not to change their passwords or account settings at this time. CEVA Logistics confirmed the breach, stating that it impacted eight European warehouses.

The incident has also reportedly affected several banks and retailers that work with Valve for shipping. Valve is seeking more information from CEVA about the scope and cause of the breach and is alerting relevant data protection authorities in the affected countries. The total number of customers impacted remains undisclosed.