Steam hardware customers in Europe are being warned about a potential data breach after Valve’s European shipping partner, CEVA Logistics, was hit by a cyberattack. The incident may have exposed delivery information belonging to people who recently purchased hardware such as the Steam Deck, Steam Machine, or Steam Controller.

According to Valve, the attack took place between July 29 and August 1, 2026. The company learned on August 7 that some Steam customer information held by CEVA may have been compromised. CEVA is still investigating the incident, so the full scope of the breach is not yet known. Potentially affected customers who bought new Steam hardware have now been notified.

Be careful of scam emails if you recently bought Steam hardware

The information that may have been accessed is limited to details needed to deliver Steam hardware. This includes customers’ names, street addresses, postal codes, cities, countries, phone numbers, email addresses, as well as the type and price of the product they ordered.

Importantly, Valve says that more sensitive information was not affected. CEVA does not have access to Steam customers’ payment details, passwords, Steam Guard codes, or other Steam account information. Valve has also said that customers do not need to change their Steam passwords or make any changes to their account settings because of this incident.

The exposed delivery information has the potential to create problems for affected customers, and users should be particularly careful about suspicious emails, text messages, and phone calls that appear to come from Steam, Valve, or a delivery company.

Scammers could use the stolen information to make their messages look convincing. For example, they could mention a customer’s name, address, or recently purchased hardware and then claim that an additional customs or delivery fee needs to be paid. They could also send a link asking the customer to sign in or confirm their order. Customers should treat such messages as fake. Steam Support will not ask for a password or Steam Guard code, and users should avoid clicking links included in unexpected emails or messages.

The breach appears to be limited to customers whose hardware orders were handled by CEVA in Europe. CEVA keeps delivery information for up to 90 days after an order, which is why Valve is notifying customers who may have been affected during that period. Despite the hefty price, Valve has been selling a lot of Steam Machines lately, though Steam Deck sales have trended down.

About the Author

Abdul Haddi

Abdul is a tech writer and Editor for PC Guide, specializing in all things tech, gaming, and hardware.