Valve issues warning to Steam Machine and Steam Controller customers to "expect fake messages" after its European hardware partner is hacked

Valve has informed Steam Machine and Steam Controller users in Europe of a data breach affecting one of its hardware partners, CEVA Logistics. CEVA Logistics, which assists Valve in distributing its hardware across the continent, experienced a breach on August 7th. Valve has cautioned customers that while passwords and payment details remain secure, the compromised data could include personal information such as names, addresses, phone numbers, countries of residence, and Steam account email addresses.

More critically, the leaked information might encompass purchase details of affected users' Steam hardware. Cybercriminals could exploit this data to craft convincing shipment emails, SMS messages, or phone calls impersonating Valve, a delivery company, or Steam. Such messages may reference a hardware order and may even quote the recipient's address to appear legitimate.

They might request a confirmation of the delivery, payment of a minor customs or redelivery fee, or even sign-in to verify the order. Valve strongly advises customers to treat all such communications as fraudulent. Additionally, Valve mentioned that CEVA is still investigating the attack, and while specific instances of malicious attempts may not arise, vigilance is crucial.

CEVA retains delivery-related information for up to 90 days post-order, which is why Valve is notifying all customers they assume were impacted. Valve is actively pressing CEVA for details on the extent of the breach and how it occurred. Furthermore, Valve has notified data protection authorities in the affected countries. In recent months, Valve has been shipping Steam Machines to customers selected through a pre-order lottery.

Steam Controllers are still being shipped, but orders placed today will not be fulfilled until 2027.