If you're based in Europe and happen to have bought Steam hardware like a Steam Deck, here's something to watch out for in your inbox and texts over the coming weeks—it's not an account hack, but a shipping data issue.
Valve recently sent notices to some European customers informing them that CEVA Logistics, the company handling shipments of Steam hardware products to Europe, suffered a data breach attack between July 29 and August 1. Valve confirmed on August 7 that the attack "likely" resulted in the leak of some customers' personal data, including names, addresses, phone numbers, emails, and order details.
Importantly, Valve emphasized that CEVA never had access to customers' payment information, passwords, or Steam Guard codes, so affected users don't need to change their Steam passwords or account settings. In other words, this breach happened on the logistics side, not through a compromise of the Steam account system itself.
Still, the data leak alone opens the door for scams. Valve directly warned in its notice that users may receive emails, texts, or calls impersonating Steam, Valve, or the logistics company, referencing your hardware order using the leaked address or order details to build trust—then trying to get you to pay a "customs fee" or "redelivery fee," or asking you to log into some page to "verify your order." Since these messages can line up with your actual order details, they'll be harder to spot than typical scam attempts.
Valve says it's currently pressing CEVA for the full scope and details of how the breach happened, and is also notifying data protection authorities in affected countries. The company has not disclosed the total number of affected users or the specific scope of notifications sent.
