If you bought a Steam Machine, Steam Deck, or Steam Controller in Europe recently, check your inbox — Valve has been sending out security notifications since August 10, warning customers that their personal data was likely compromised in a cyberattack on its European shipping partner. The company in question is CEVA Logistics, one of the world’s largest shipping and logistics operators, and the breach hit eight of its European warehouses during a four-day window at the end of July.
Valve said the attackers had access to CEVA Logistics’ servers between July 29 and August 1, 2026, which allowed them to gain access to information needed to ship hardware orders to Steam customers. Valve confirmed it first learned of the attack on August 7 and began notifying affected customers on August 10. The notification went out by email to anyone who ordered Steam hardware through European channels within the past 90 days — that being how long CEVA retains delivery information after an order is placed.
Exactly What Data Was Compromised
Valve has been clear about what CEVA did and did not have access to. The breach exposed delivery-related information tied to hardware orders, including the customer’s full name, street address, postal code, city, country, phone number, the email address linked to their Steam account, and details about the type and price of the hardware ordered.
What was not affected is equally important to flag. Valve has stressed that no Steam account credentials, passwords, Steam Guard codes, or payment information were affected, since CEVA never had access to that data in the first place. Your Steam account is not at risk. There is no need to change your password or alter any account settings as a direct result of this breach.
The practical risk here is not account takeover — it’s phishing and social engineering. Valve’s notification explicitly warned customers to expect fake messages — email, SMS, or phone — that mention your hardware order and appear to come from Steam, Valve, or a delivery company. The concern is that an attacker armed with your name, address, phone number, and knowledge of what hardware you ordered can construct an extremely convincing fake message claiming you need to pay an additional fee, verify your order on a fraudulent site, or confirm login details. Do not respond to any such messages. Valve will not contact you to request payment or account sign-in through unsolicited outreach.
The Broader CEVA Breach: This Goes Beyond Steam
What makes this story larger than a Valve-specific incident is the scale of CEVA’s operation and the number of companies affected. The cyberattack on CEVA is affecting at least eight warehouses across Europe used for shipping goods across the continent, causing shipping delays for many of the goods in affected warehouses.
The fallout has since widened to include football club Ajax, banking giant ING, and eyewear retailer Ace & Tate, all of which rely on CEVA for order fulfilment and have separately notified customers that their shipping data was also affected. CEVA confirmed the breach to TechCrunch, stating that its cybersecurity teams immediately activated security protocols and launched a thorough investigation upon identifying the incident, with operational impact limited to those eight warehouses and no other CEVA systems globally affected.
Whether a ransom demand has been made or received is unknown. CEVA’s spokesperson declined to answer questions about how much personal data was taken, or whether the company has received any communication from the attackers. The investigation is ongoing, and CEVA has isolated the affected systems and brought in external investigators.
Valve’s designated contact point for further enquiries about the incident is: Artana Digital GmbH, Alstertwiete 3, 20099 Hamburg, Germany. For support-related questions, Valve is directing users to help.steampowered.com. Valve has also confirmed it is actively notifying data protection authorities in all affected European countries, which is a legal requirement under GDPR for breaches of this type.
Who Specifically Got the Warning
Reports from users confirm that both Steam Machine and Steam Controller customers have received the warning, and at least one Windows Central writer confirmed receiving a notification despite only ordering a Steam Controller in May — not a Steam Machine. Valve is sending the message to all customers it can assume were impacted, based on the 90-day data retention window CEVA applies to order records. So if you ordered any Steam hardware shipped through a European fulfilment centre since early May 2026, you should expect to receive a notification. If you haven’t received one yet and believe you fall in that window, monitor your inbox and check your Steam account email settings to confirm the correct address is on file.
The total number of affected users has not been disclosed. Valve itself is still working to get the full details of the cyberattack and is pressing CEVA for the complete scope of what was taken and how.
The Wider Context: Gaming Data Breaches in 2026
The CEVA breach arrives in a year that has already seen several notable gaming-adjacent data security incidents. In May 2026, Sony cautioned PlayStation Network users after several PSN accounts were compromised using only account IDs and transaction details — no phishing required — with Sony warning users to be careful about what personal information they share publicly. The two incidents are structurally different, but both underline the same broader point: shipping and account data connected to gaming platforms is actively being targeted, and the consequences of those breaches extend beyond the gaming companies themselves into logistics, finance, and retail partners.
The CEVA situation is particularly instructive because it demonstrates how a breach at a third-party logistics partner — a company most customers have never heard of and whose data handling they never consented to directly — can expose personal information at scale. Every time you buy physical hardware that ships through a third-party fulfilment network, your delivery data passes into systems you have no direct visibility over. That’s not a new vulnerability, but it’s one worth understanding clearly.
What You Should Do Right Now
If you’ve received Valve’s notification email, here’s a straightforward action list:
- Do not respond to any unsolicited messages referencing your Steam hardware order — email, text, or phone call. Treat all of them as phishing attempts until proven otherwise.
- Do not click links or visit websites mentioned in any unexpected messages about your Steam order, fees, or account verification.
- Do not pay any fee claimed to be required to release or verify your hardware shipment — this is not how Valve or legitimate couriers operate.
- Your Steam account is safe — no password change is required as a result of this breach specifically. That said, if your Steam account password is reused across other services, now is always a reasonable time to update it regardless.
- Consider enabling Steam Guard if you haven’t already, which adds two-factor authentication to your account and protects against unauthorized login even if an attacker obtains your email address.
For more on the biggest gaming news this week, check out our full coverage of the No Man’s Sky Cosmos update tease and Sean Murray’s 10th anniversary letter, everything confirmed about the Warhammer 40,000 animated series with Henry Cavill as executive producer, and the story of how Steam approved a Battlefield 6 refund after 470 hours following the Rush mode removal.
