European customers who purchased Valve’s Steam Machine or Steam Controller are facing potential exposure of their personal information after a cyberattack targeted CEVA Logistics, a distribution partner responsible for Valve’s European supply chain. The breach was reported on August 7, prompting Valve to take immediate action to notify affected customers.
A spokesperson for Valve confirmed that the company spent the weekend compiling a list of those at risk and began notifying them via email on Monday morning. “Though CEVA is still investigating the attack, we wanted to at least send out messaging to all customers we can assume were affected based on what we currently know,” the spokesperson stated.
The data compromised in the breach reportedly includes customers’ names, countries, street addresses, phone numbers, and email addresses. However, Valve assured that sensitive details such as payment information, passwords, and Steam Guard codes remain secure, as CEVA does not have access to this data.
Given that phone numbers and email addresses linked to Steam accounts are now circulating, Valve has warned users to be vigilant against phishing attempts that may exploit this information. “Expect fake messages – email, SMS, or phone – that mention your hardware order and appear to come from Steam, Valve, or a delivery company,” the company warned in its communication to affected individuals. “They may quote your address back to you to prove they’re genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to ‘verify’ your order. Treat all of them as fake.”
Valve also reminded customers that the Steam support team only addresses issues through the official help page and never communicates via Steam chat or third-party services. Employees will never ask for passwords or Steam Guard codes.
The specifics of the cyberattack remain unclear, with no official figures released regarding the number of affected customers or the extent of the data stolen. Valve has indicated that it is pressing CEVA for a comprehensive understanding of the situation.
In addition to the ongoing internal investigation at CEVA, authorities in the Netherlands have launched their own inquiry into the attack. A spokesperson for the Dutch data protection authority confirmed to TechCrunch that the agency has received reports of data breaches from at least ten companies related to this incident.
Furthermore, operations at eight of CEVA’s warehouses have been impacted by the cyberattack, leading to potential delays or cancellations of customer orders in the near future, as reported by FreightWaves.
CEVA Logistics has not yet responded to requests for comment regarding the incident.
