Valve Steam Hardware buyers hit with cyberattack in Europe

Valve notifies Steam Hardware customers of a cyberattack

This morning, Valve sent an email to European Steam Machine and Steam Controller customers to inform them that their personal information has been leaked through a Cyberattack. CEVA Logistics, which handles Steam’s hardware shipping/logostics in Europe, was the group that was attacked. Valve was notified of the hack on August 7th and informed affected customers this morning.

Valve has confirmed that no payment information or passwords were compromised due to this attack. CEVA Logistics were only given the information needed to ship orders to customers. Compromised information includes the names, addresses, phone numbers, Steam account email, and Steam hardware order details of Steam hardware purchasers. Note that no Steam passwords, Steam Guard codes, or payment details have been accessed. CEVA never had this information to begin with.

Valve has emailed affected customers to prevent its customers from being tricked by attackers using their private information. Affected Steam users have been warned about the fake messages, emails, or phone calls that attackers may send them. Attackers could use compromised information to “prove” their legitimacy. Steam Hardware purchases have been told to treat all such messages or contact attempts as fake.

Valve is currently notifying relevant data protection authorities in affected countries. CEVA has reportedly taken its systems offline. Furthermore, they have brought in external investigators to look into the incident. Note that Valve has not disclosed how many users have been affected by this cyberattack. If you want to contact Valve, you can do so on Steam’s support site. Valve’s full email to affected customers is available to read below.

Between July 29 2026 and August 1, 2026, a cyberattack hit CEVA Logistics, the company that ships Steam hardware to customers in Europe. CEVA is still investigating this attack, but as Valve learned on August 7, certain information about Steam customers, including you, was likely compromised.

CEVA receives specific delivery-related information from Steam to be able to ship physical hardware to customers in Europe, and told us these are the details the attacker likely took. Because CEVA retains this information for up to 90 days after that order, we are sending this message to all customers we can assume were impacted.

For you, that means the following information related to your hardware purchase may have been compromised:
* your name
* your street address, postal code and city
* your country
* your phone number
* your email address — the same one your Steam account uses
* the type and price of the ordered product

Additional information related to your Steam account or other purchases was not impacted. CEVA does not have access to your payment information, passwords, Steam Guard codes or other information.

What this means for you
Expect fake messages – email, SMS or phone – that mention your hardware order and appear to come from Steam, Valve or a delivery company. They may quote your address back to you to prove they’re genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to “verify” your order. Treat all of them as fake.

You do not need to change your Steam password, and you don’t need to do anything to your account settings.

Three things that are always true
* Steam Support only handles account issues at https://help.steampowered.com/. Never by email, Steam Chat or Discord. Anyone who contacts you elsewhere claiming to be Steam Support is not.
* Every real Steam login page is on store.steampowered.com, www.steampowered.com, steamcommunity.com or help.steampowered.com. Type the address yourself rather than following a link someone sent you.
* Steam Support will never ask you for your password or a Steam Guard code. Neither will a courier.

What we’re doing
We’re pressing CEVA for the full scope of what was taken and how, and we are in the process of notifying the data protection authorities in the countries affected, including yours. CEVA has isolated the affected systems, taken all offline and brought in outside investigators.

If you have questions about this incident, the quickest way to reach us is our support site at help.steampowered.com. You can also write to the contact point we have designated for further information about this incident: Artana Digital GmbH, Alstertwiete 3, 20099 Hamburg, Germany.

You can join the discussion on European Steam Controller and Steam Machine customers being hit by a cyberattack on the OC3D Forums.