Valve has confirmed that some customers’ personal details may have leaked as part of a cyberattack on CEVA Logistics. In an email sent to Steam account holders, details on what happened, what details are at risk, and what it’s doing to make amends were explained.
The attack on CEVA Logistics, which is the company that ships Steam hardware to customers in Europe, happened between Wednesday, July 29, 2026, and Saturday, August 1, 2026. On Friday, August 7, Valve became aware of exactly what info leaked. Thankfully, no payment details, account passwords, or Steam Guard codes have been accessed because they’re never shared with CEVA Logistics.
Those affected may have seen their postal address, phone number, and email address recorded by the hackers. Valve does reiterate that no other information could have been taken, as it is never shared with the logistics company. Instead of having all of the same account information as Valve does, “CEVA receives specific delivery-related information from Steam to be able to ship physical hardware to customers in Europe, and told us these are the details the attacker likely took. Because CEVA retains this information for up to 90 days after that order, we are sending this message to all customers we can assume were impacted,” the email explains.
Thankfully, that means you don’t have to cancel payment cards or change passwords, but you will need to stay vigilant when receiving correspondence about Steam products. You may receive fake messages to your email address or phone, so be extra cautious when engaging with promotional content sent directly to you.
Valve is working to get a full picture of what information has been taken, and how. It is “in the process of notifying the data protection authorities in the countries affected. CEVA has isolated the affected systems, taken all offline and brought in outside investigators,” so keep an eye on further emails from Valve with more information. For now, there is nothing you need to do with your Steam account.