Valve warned Steam Machine and Steam Controller customers in Europe on August 10 after a cyberattack at CEVA Logistics may have exposed their personal and order information. CEVA handles Steam hardware fulfillment across Europe and told Valve about the incident on August 7. Valve began contacting potentially affected customers after receiving enough information over the weekend to identify possible exposures.
The attack took place between July 29 and August 1, 2026. CEVA was still investigating when Valve sent its customer warning, so the full scope of the incident had not yet been confirmed. The available information does not indicate that U.S. customers were affected.
What Steam customers may have exposed
Valve said the compromised information may include the customer’s name, street address, city, postal code, country, phone number, email address linked to the Steam account, and other contact details. The price and type of Valve product ordered may also be involved. CEVA retains customer details for 90 days to handle returns and delivery problems.
The company said it was pressing CEVA Logistics to determine exactly what data was taken and how the attackers accessed it, and was notifying data protection authorities in every affected country. Valve also said payment details and information from other purchases were not impacted. The warning did not indicate that Steam account passwords or account settings were compromised.
Eight CEVA warehouse hubs were also impacted, causing shipping delays for retail partners across Europe, according to a FreightWaves report.
Valve warns about follow-up scams
The clearest risk for customers now is a wave of convincing phishing attempts. Valve warned that fake emails, text messages, and phone calls could mention a hardware order, quote a customer’s address, or imitate Steam, Valve, or a delivery company.
Those messages may ask recipients to confirm a delivery, pay a small customs or redelivery fee, or sign in to verify an order. Valve said customers should treat those requests as fraudulent, even when the message includes accurate personal information.
Anyone with questions should use Steam Support. Valve emphasized that account issues will not be handled through email, Steam Chat, Discord, or another outside contact channel. The company also said customers do not need to change their Steam passwords or other account settings because of this incident.
Steam Machine reservations are still being processed
The warning comes as Valve continues working through its Steam Machine reservation queue. Current reservation holders are expected to receive purchase invitations by the end of 2026, although the invitation itself does not mean the hardware will arrive immediately. The ongoing Steam Machine reservation process gives scammers another reason to target customers who are already waiting for order updates.
Anyone who receives an unexpected message about a Steam hardware delivery should avoid its links and enter the support address directly in a browser. Share your thoughts in the comments, and follow us on X, Bluesky, YouTube, Instagram, Steam, and Telegram.
