Steam Hardware Buyers' Addresses Leaked in Cyberattack

Between July 29 and August 1, hackers breached CEVA Logistics, the third-party company Valve uses to ship Steam hardware across Europe. Valve says it learned about the attack on August 7 and has now begun emailing affected customers directly. If you bought a Steam Machine, Steam Controller, or Steam Deck in Europe within the last 90 days, your personal data was likely part of the haul.

The compromised information includes full names, street addresses, postal codes, phone numbers, countries of residence, and the email addresses tied to Steam accounts. Purchase details, including what product was ordered and how much it cost, were also likely taken. Valve confirmed all of this in an email to customers, which was first shared publicly on ResetEra and subsequently posted by multiple Reddit users.

Passwords, payment information, and Steam Guard codes were not exposed. CEVA never had access to that data in the first place, so there's no need to change your Steam password or adjust account settings. But what was taken is more than enough to fuel convincing phishing attacks, and Valve's warning about that is unusually specific:

Expect fake messages, email, SMS or phone, that mention your hardware order and appear to come from Steam, Valve or a delivery company. They may quote your address back to you to prove they're genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to 'verify' your order. Treat all of them as fake.

I want to stress how effective this kind of scam can be. Someone emails you with your real name, your real address, and the exact Steam hardware you ordered, asking you to pay a £2.50 customs fee to release your package. Most people wouldn't think twice. Valve is right to be blunt here: treat every single one of those messages as fraudulent, no matter how real they look.

What CEVA Retains and Why

CEVA Logistics holds onto delivery-related customer data for up to 90 days after an order ships. Because Valve has been actively distributing Steam Machines to customers who won its pre-order lottery over the past couple of months, and Steam Controllers continue shipping with backorders stretching into 2027, there's a substantial pool of recent buyers whose data sat in CEVA's systems during the breach window.

Valve reiterated that Steam Support only operates through help.steampowered.com and never contacts users via email, Steam Chat, or Discord. Legitimate Steam pages exist only on store.steampowered.com, www.steampowered.com, steamcommunity.com, or help.steampowered.com. If you get a link that doesn't match one of those domains, don't click it. Type the address yourself.

CEVA has reportedly isolated the affected systems, taken them offline, and brought in external investigators. Valve says it is "pressing CEVA for the full scope of what was taken and how" and is notifying data protection authorities in all affected countries.

This breach didn't touch Valve's own servers, and no account credentials were compromised. It could have been far worse. But home addresses paired with confirmed purchase history is a particularly nasty combination for social engineering. If you've received Valve's email, the next few weeks are when you need to be most cautious. Every delivery notification, every customs fee request, every "verify your order" prompt should be assumed fake until you can confirm it through Steam's own support page. Valve handled the disclosure quickly and with clear language; now it's on CEVA to explain how this happened in the first place.