Valve’s shipping partner leaks shipping data in a cyberattack — including the names, addresses, and phone numbers of Steam Machine and Steam Controller buyers

Developer August 10, 2026No Comments

If you ordered any of Valve’s products within Europe, such as its Steam Machine gaming PC or the modern Steam Controller, there’s a chance your private information may have been compromised. This morning, an email detailed “a note about a security incident at our shipping partner in Europe” involving a cyberattack on Valve’s EU shipping partner, CEVA Logistics, on August 7.

Expect fake messages – email, SMS or phone – that mention your hardware order and appear to come from Steam, Valve or a delivery company.
Valve

I bought the Steam Controller in May, though I skipped the Steam Machine pre-order queue, and still received the notice as a customer in the United Kingdom. Crucially, Valve clarifies that this attack on CEVA and its subsequent data breach does not affect “your payment information, passwords, Steam Guard codes or other information.”

Your Steam account should remain safe, and right now, there’s no reason to change your password or change any account settings. However, Valve warns that customers could “expect fake messages” from bad actors asking for money or other information. Personal details that “may have been compromised” include:

Your name
Your street address, postal code and city
Your country
Your phone number
Your email address — the same one your Steam account uses
The type and price of the ordered product

How did the CEVA Logistics breach happen?

Steam Machine for 2026 — Steam Machine buyers report receiving the same email, presumably affecting all European hardware shipments. (Image credit: Valve)

Valve says that it is “pressing CEVA for the full scope of what was taken and how, and we are in the process of notifying the data protection authorities in the countries affected”, and clarifies that the affected system has been taken offline and isolated from further leaks, but there is currently no confirmation on which customers have been affected or exactly how this happened.

For now, Valve invites anyone with concerns or questions to reach out to its support team at help.steampowered.com or to write to its contact point at Artana Digital GmbH, Alstertwiete 3, 20099 Hamburg, Germany.

Fake messages from convincing impersonators are unfortunately common, and bad actors will go through extreme lengths to make their text messages, emails, and phone calls appear genuine. If you’re new to Steam, remain vigilant but remember that Valve only handles account issues via its dedicated support site, and “never by email, Steam Chat, or Discord — Anyone who contacts you elsewhere claiming to be Steam Support is not.”

I’d also caution anyone who might be at risk that, while Valve implies that your credit card information is safe, bad actors can use other personal information to attempt various identity fraud and access accounts elsewhere. It’s important to stay vigilant as data breaches like this happen, and scrutinize every message you receive from delivery companies asking for money: “Treat all of them as fake“, Valve says.

Customers based in the United States and, in turn, anywhere outside CEVA Logistics’ operating area in Europe shouldn’t be affected by this breach. Nevertheless, it should come as an important lesson in customer privacy and data security. Keep using strong passwords that are unique to each platform, and protect yourself as much as possible.