European Steam Hardware customers, beware. If you made your order at any point in the three-month period leading up until roughly August 1st, 2026, your information has likely been compromised. This is because a cyberattack hit CEVA Logistics, Valve's shipping partner for customers in EU regions. CEVA's data includes your name, address, phone number, email, and even the exact product you ordered. No password or 2FA information was compromised, thankfully.

In the email Valve sent disclosing this, Valve told potential victims of the breach to expect phishing attempts from Valve or delivery company impersonators over email, SMS, and sometimes even voice calls. These impersonators may then demand delivery confirmation, a signature, a customs fee, etc. Valve warns to "treat all of them as fake" and reassures users that there's no need to change Steam passwords or settings.

Example Steam Support email - Image: @joel.zone on BlueSky

The earliest report we know of Valve's email alert came through the Resetra forums, but reports have since been seen across social media and other outlets. Sadly, Valve doesn't have a dedicated support webpage for this incident. But as far as data breaches go, it is at least less severe than other breaches we've reported on. These things often involve full-blown password leaks.

The full breadth of the impacted users is still unknown at this time, but the maximum affected pool should just be EU customers shipped to by CEVA Logistics in a three-month period ending between July 29th and August 1st, 2026. This period corresponds to CEVA's own policy to only retain shipping information for up to 90 days after the order, but there's still a chance hackers only received a more limited slice of that information. A full attack autopsy could illuminate what was and wasn't taken, but we don't have that yet.

Otherwise, for European Steam users, it's business as usual. There may be more directed phishing or scam attempts in the coming months, but those can be safely ignored. With any luck, your spam filter should still catch them automatically.