Seemingly, only Europeans are affected

Image credit: Rock Paper Shotgun

If you live in Europe and have bought hardware from Steam in the past three months, then watch out, your personal information might have been stolen thanks to a cyberattack on one of Valve's shipping partners.

"Between July 29 2026 and August 1, 2026, a cyberattack hit CEVA Logistics, the company that ships Steam hardware to customers in Europe," reads a Valve email published by Gaming On Linux's Liam Squires-Hand, which has also been shared separately by Reddit users. "CEVA is still investigating this attack, but as Valve learned on August 7, certain information about Steam customers, including you, was likely compromised." CEVA have apparently "isolated the affected systems, taken all offline and brought in outside investigators".

According to the email, CEVA obtains delivery info from Valve, including your name, phone number, email, and postal address, when shipping Steam hardware to people in Europe. CEVA retain that info for up to 90 days after order. If you've been mailed about this by Valve, it doesn't mean your data has definitely been pinched: the email notes that Valve have decided to contact anybody "we can assume were impacted".

Seemingly, you don't need to worry about credit card information or nuking your Steam logins, as "CEVA does not have access to your payment information, passwords, Steam Guard codes or other information".

If you have fallen victim to the CEVA hack, you can look forward to a bunch of spam. "Expect fake messages - email, SMS or phone - that mention your hardware order and appear to come from Steam, Valve or a delivery company," the email reads. "They may quote your address back to you to prove they're genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to 'verify' your order. Treat all of them as fake."

The email notes that Steam Support never handle issues over email, Steam chat or Discord, so don't believe anybody who tries to hustle you on there. Also, don't click any links you get in suspect emails – type in the Steam store address yourself. And don't give anybody your password or Steam Guard code. All pretty standard safety malarkey.

The email promises that Valve are "pressing CEVA for the full scope of what was taken and how, and we are in the process of notifying the data protection authorities in the countries affected, including yours."

It seems unlikely, but not impossible that the email itself is a really tortured bluff on the part of some wily cyberburglars, designed to trick you into lowering your guard somehow. One can never be too careful, and I have duly sent Valve a request for clarification via channels I trust. I wrote all of it in capital letters to make sure they take me seriously. Whatever the truth of the matter, none of this is going to help sell Steam Machines.