Valve has confirmed that personal information belonging to some European customers who purchased Steam hardware was exposed in a cyberattack against CEVA Logistics, the company's regional shipping partner.

Valve has begun notifying customers who may have been affected by the breach, which occurred at CEVA between July 29 and August 1. Valve said it became aware of the incident on August 7.

The breach first came to light through reports from affected customers on online forums, including ResetEra and Reddit, where users shared screenshots of notifications they had received from Valve.

According to Valve, CEVA retains delivery-related information for up to 90 days after an order is placed. As a result, Valve is notifying customers whose orders fell within that period and whose information may have been accessed.

What information was exposed?

The compromised information includes names, street addresses, postal codes, cities, countries, phone numbers and the email addresses associated with customers' Steam accounts.

The data also includes information about the hardware ordered, including the type of product and its price.

Customers who purchased Steam Deck, Steam Machine or Steam Controller hardware are believed to make up much of the affected group.

Valve stressed that more sensitive account and payment information was not compromised. Payment details, passwords, Steam Guard codes and other Steam account information were not included in the affected data.

The company also said customers do not need to change their Steam passwords or account settings as a result of the incident.

However, Valve is warning affected customers to remain alert for potential phishing attempts.

Scammers could use information from the breach to make fraudulent messages appear more convincing. Emails, text messages or phone calls could reference a customer's Steam hardware order or even include their real address.

Valve reminded customers that official Steam Support is only available through help.steampowered.com and will never ask users for their passwords or Steam Guard codes.

CEVA confirms European breach

CEVA Logistics has confirmed that the incident affected part of its European contract logistics operations.

The France-based logistics company said the cyberattack disrupted operations at at least eight European warehouses.

The breach appears to extend beyond Steam customers. Other companies, including banks and retailers that use CEVA for logistics and shipping, have reportedly been affected by the incident.

Valve said it is continuing to work with CEVA to determine exactly how the breach occurred and how much information was accessed.

The company is also notifying data protection authorities in the countries where affected customers are located.

The total number of Steam customers whose information was exposed has not yet been disclosed.

For affected customers, the incident appears to be primarily a privacy and phishing risk rather than a direct compromise of Steam accounts. Valve's warning suggests that the most immediate concern is the possibility of attackers using genuine order information to make future scams appear legitimate.