Valve is notifying Steam Machine and Controller customers of a data breach revealing personal information

| By
Valve Breach

Buyers of Steam Machines and Steam Controllers have begun to be notified via email of a potential data breach related to a cyberattack occcuring between July 29, 2026 and August 1, 2026 on CEVA Logistics, which facilitates Steam hardware deliveries in Europe.

Valve has informed affected customers that certain information related to their orders was likely compromised as a result of this cyberattack, which could reportedly have scraped up to 90 days worth of data – including names, postal addresses, phone numbers, emails and the details of the items purchased, including price.

Obviously this is potentially very concerning for European customers who fall into the timeframe of this breach, and now face a high likelihood of scammers using their personal information to commit identity fraud or bombard them with email and text spam.

Here’s what the email states:

Hello,

Between July 29 2026 and August 1, 2026, a cyberattack hit CEVA Logistics, the company that ships Steam hardware to customers in Europe. CEVA is still investigating this attack, but as Valve learned on August 7, certain information about Steam customers, including you, was likely compromised.

CEVA receives specific delivery-related information from Steam to be able to ship physical hardware to customers in Europe, and told us these are the details the attacker likely took. Because CEVA retains this information for up to 90 days after that order, we are sending this message to all customers we can assume were impacted.

For you, that means the following information related to your hardware purchase may have been compromised:

  • your name
  • your street address, postal code and city
  • your country
  • your phone number
  • your email address – the same one your Steam account uses
  • the type and price of the ordered product

Additional information related to your Steam account or other purchases was not impacted. CEVA does not have access to your payment information, passwords, Steam Guard codes or other information.

What this means for you

Expect fake messages – email, SMS or phone – that mention your hardware order and appear to come from Steam, Valve or a delivery company. They may quote your address back to you to prove they’re genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to “verify” your order. Treat all of them as fake.

You do not need to change your Steam password, and you don’t need to do anything to your account settings.

Three things that are always true

What we’re doing
We’re pressing CEVA for the full scope of what was taken and how, and we are in the process of notifying the data protection authorities in the countries affected, including yours. CEVA has isolated the affected systems, taken all offline and brought in outside investigators.

If you have questions about this incident, the quickest way to reach us is our support site at help.steampowered.com. You can also write to the contact point we have designated for further information about this incident: Artana Digital GmbH, Alstertwiete 3, 20099 Hamburg, Germany.

Valve is yet to issue a more broad, public-facing statement, but we’ll keep you updated.

Like our news stories? Hate dodgy AI summaries? Click here to add covergeek as a Preferred Source on Google and see our posts more often!

[Feature image partially sourced from u/legiondarrath]

[10/8/26 – The article headline has been updated for clarity]