Customer Data, Including Names and Addresses, Exposed in Steam Hardware Breach

Valve has alerted customers that a data breach may have compromised personal information for those who ordered Steam hardware in Europe. In a message to users, Valve explained that its European shipping partner, CEVA Logistics, experienced a breach that could have exposed customer names, addresses, phone numbers, and email addresses.

The incident at CEVA took place between July 29th and August 1st, shortly after Valve started accepting reservations for the new Steam Machine and Steam Controller. Valve indicated that European customer data “was likely compromised” due to CEVA retaining “delivery-related information” for up to 90 days post-order.

As a precaution, Valve warns users to be on the lookout for fraudulent messages via email, text, or phone that may appear to be from Steam, Valve, or a delivery service. These messages might reference your address to seem legitimate and could request confirmation of a delivery, payment of a small customs or redelivery fee, or prompt you to log in somewhere to “verify” your order. Valve advises treating all such communications as scams.

The notice reassures users that additional data linked to their Steam accounts or purchases remains secure, emphasizing that CEVA “does not have access to your payment information, passwords, Steam Guard codes, or other sensitive details.” Valve also reminds users that any account-related issues should be addressed through their official support site and that they will not reach out via email, Steam chat, or Discord.