Valve has confirmed that a cyberattack on CEVA Logistics led to a breach of personal data belonging to purchasers of Steam hardware.

Valve has alerted its European clientele that personal details may have been compromised following a security breach at CEVA Logistics. This organization is responsible for managing Steam hardware shipments in the region.

The first reports of the data breach emerged on platforms such as ResetEra and Reddit, where users began sharing screenshots of Valve's notification email. Valve’s email, which was viewed by GamesIndustry.biz, explained that the breach at CEVA took place from July 29 to August 1, with Valve being informed of the issue on August 7.

Due to CEVA's policy of retaining delivery data for 90 days, Valve is alerting any customer possibly affected within this timeframe. The breach exposed customer names, addresses, postal codes, cities, countries, phone numbers, associated email addresses, and the type and cost of the hardware purchased. Likely affected are those who bought the Steam Deck, Steam Machine, and Steam Controller. Valve assured customers that no financial data, passwords, Steam Guard codes, or other account info were compromised, thus there is no need for users to modify their passwords or account settings.

Valve cautioned users to be vigilant against phishing scams referencing their orders, potentially using the customer's actual address. The company emphasized that Steam Support communicates solely through help.steampowered.com and never asks for passwords or Steam Guard codes.

CEVA acknowledged the incident in a statement to TechCrunch, revealing that part of its European contract logistics operations were affected. The breach impacted at least eight European warehouses and reportedly extended to financial institutions and retailers relying on CEVA for logistics.

Valve is seeking more information from CEVA regarding the breach's scale and mechanics while coordinating with data protection agencies in the impacted nations. The total number of customers impacted remains undisclosed.