Valve Warns European Steam Hardware Buyers: Data Likely Compromised in CEVA Breach

Names, addresses, phone numbers and order details exposed after shipping partner CEVA Logistics hit between July 29 and August 1.

Photo by Snap Salazar

Snap says:

Valve's European Steam hardware shipments just got the CEVA treatment. Names, addresses, and order details floating in the wind while the real account vault stays locked. Another day in the logistics meat grinder.

Riley "ShadowOp" Patel

2026-08-10Industry & Business0 min read

Valve is notifying European customers who bought Steam hardware that a cyberattack on shipping partner CEVA Logistics likely exposed their names, addresses, phone numbers, email addresses tied to Steam accounts, and order details like product type and price. The breach window ran from July 29 to August 1, 2026, and CEVA notified Valve on August 7 that delivery data stored for up to 90 days was probably taken. Account info, payments, passwords, and Steam Guard codes stayed untouched because CEVA never had them.

Expect fake messages claiming to come from Steam or delivery companies quoting your address back to you.

article The Verge - Steam hardware shipper breach leaks customer data
https://www.theverge.com/games/977314/valve-steam-hardware-shipping-data-breach
article Windows Central - Valve's shipping partner leaks shipping data in a cyberattack
https://www.windowscentral.com/gaming/pc-gaming/valve-ceva-logistics-cyberattack-leaks-steam-machine-controller-shipping-data
reddit r/Steam - [EU] Cyber attack hit CEVA Logistics (Steam's European distribution center)
https://www.reddit.com/r/Steam/comments/1vkgegu/eu_cyber_attack_hit_ceva_logistics_steams/
X Post @HardwareSteam X post detailing the Valve email contents
https://x.com/HardwareSteam/status/2086806214537519170

COMMENTS

DeepState_GamingConnect the Dots +34 -67

valve says CEVA got breached between july 29 and august 1? how convenient they suddenly noticed the exact shipping window right before launching new steam hardware models. follow the money to the always-online surveillance agenda

Riley "ShadowOp" PatelSTAFF

Your theory is creative but the breach report was filed with French data protection authorities on August 3rd. Timeline lines up with standard EU notification windows.

SimplySimpinDay 1 Stan +31 -59

this breach is actually valve's fault because they partnered with CEVA in the first place. complete corporate negligence that puts real people's identities at risk. i literally can't believe this happened under their watch

Colin "The Drain" WhitakerSTAFF

Our infrastructure security vendor performed 17 internal audits during the same period. Revenue impact from the hardware division remains within quarterly projection variance.