Valve User Data Compromised in Cyber Attack on European Partner

Valve is reaching out to a select group of Steam users, particularly those who have bought Valve hardware, to inform them about a cyberattack that affected its shipping partner in Europe, CEVA Logistics, in late July.

This information has surfaced from Steam users themselves, with several posts on various forums detailing an email from Valve that includes insights from the CEVA Logistics report.

The email reveals that CEVA Logistics was compromised between “July 29 and August 1” of this year, although Valve states they became aware of the incident on August 7. However, a Dutch news outlet reported that two companies, Bol and De Bijenkorf, were notified of the breach on August 1.

While the email reassures users that their “Steam account[s] or other purchases were not impacted,” it does indicate that personal information such as phone numbers, addresses, email addresses, and names “may have been compromised.”

Valve clarifies that CEVA Logistics is responsible for shipping Steam hardware to customers in Europe, suggesting that only those who purchased Steam-related hardware in that region might be affected.

The email also mentions that CEVA Logistics retains user information for up to 90 days after an order, implying that anyone in Europe who bought a Steam product since late April could be at risk. Consequently, Valve has advised users to be cautious of “fake messages” via email, SMS, or phone that reference their hardware order and seem to originate from Steam, Valve, or a delivery company.

As of now, neither Valve nor CEVA Logistics has issued an official statement about the cyberattack, opting instead to communicate directly with potentially affected customers. Therefore, the exact number of Steam users whose information may have been compromised remains unconfirmed.