Valve Notifies EU Customers of Data Breach via Shipping Partner

Valve is notifying European customers of a data breach that compromised personal information after a cyberattack on its shipping partner, CEVA Logistics. The incident, which occurred between July 29 and August 1, 2026, exposed names, addresses, phone numbers, and email addresses linked to hardware orders placed within the past three months.

Valve confirmed it learned of the breach on August 7 and began emailing affected customers on August 10. The company stated that CEVA Logistics, which handles shipping for Steam Deck, Steam Controller, and Steam Machine orders in Europe, was the target of the attack. CEVA is a subsidiary of the CMA CGM Group, the world's third-largest shipping company.

The compromised data includes full names, street addresses, postal codes, cities, countries, phone numbers, and email addresses associated with Steam accounts. Attackers also accessed details about the ordered hardware, including its type and price. Valve emphasized that no Steam account information was affected. CEVA never had access to payment details, Steam passwords, Steam Guard codes, or other sensitive account data, so login credentials remain secure.

Valve warned affected customers to be...