Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe

A cyberattack has compromised personal information of Steam users in Europe, according to a report from Valve. The breach occurred at CEVA Logistics, a partner responsible for shipping Steam hardware to customers in Europe between July 29, 2026, and August 1, 2026. CEVA, which retains delivery information for up to 90 days, obtained names, phone numbers, email addresses, and postal addresses from Valve when shipping hardware to European customers.

Valve has alerted users about the potential data breach and urged them to be cautious of fake messages that may appear to be from Steam, Valve, or delivery companies. These messages may request personal information or financial details, but Valve has stated that credit card information, passwords, Steam Guard codes, and other sensitive data were not compromised. Users should disregard any suspicious communications and avoid clicking on links or providing any personal information.

Valve is working with CEVA to determine the extent of the data breach and is notifying relevant data protection authorities. While there is a possibility that the email could be a sophisticated attempt to deceive users, Valve advises users to follow standard safety precautions, such as not clicking on links, not sharing passwords or Steam Guard codes, and typing in Steam store addresses directly.

The report emphasizes the importance of vigilance in protecting personal information, especially in light of recent cyber threats.