Valve has warned European Steam users about a cyberattack on CEVA Logistics, a third-party logistics company that handles the delivery of physical Steam hardware in Europe. According to Valve, the incident occurred between July 29 and August 1, 2026, and the company learned about the possible compromise of user data on August 7.
Since CEVA receives information necessary for order delivery, attackers may have gained access to data of customers who placed orders for Steam hardware. This includes the following information:
- first and last name
- residential address, including street, city, and postal code
- country
- phone number
- email address associated with the Steam account
- type and cost of the ordered item
Valve emphasizes that Steam account data itself was not affected. CEVA did not have access to payment information, Steam passwords, Steam Guard codes, or other user account data.
Only customers who placed hardware orders within approximately the last 90 days are at risk. This is how long CEVA stores relevant delivery data.