Valve says Steam hardware data was not exposed in CEVA breach after all

Valve told European Steam hardware customers that a cyberattack on its shipping partner, CEVA Logistics, did not reach the systems that processed their orders, walking back an August warning that their personal data may have been exposed.

Valve said in an email to affected buyers that while CEVA has not concluded its full investigation, the attack was limited to a subset of CEVA’s systems and that the system handling Steam hardware orders was not affected. The company said there is currently no indication that customer data was accessible to the attacker at any point during the incident, and it apologized for the delay in confirming this and for any confusion or alarm caused by its earlier notice.

In August, Valve had warned European Steam hardware customers that a cyberattack on CEVA Logistics may have exposed their names, addresses, contact details and order history. The company said no passwords, payment data or Steam Guard codes were involved, and advised customers to watch for phishing attempts, including messages that quote a customer’s own address back to them, request payment of a customs or redelivery fee, or ask customers to sign in somewhere to "verify" an order.

CEVA Logistics, a subsidiary of French shipping company CMA CGM with more than 1,300 locations, over 110,000 employees and more than $18.3 billion in revenue last year, was hit by the cyberattack between July 29 and Aug. 1, 2026. CEVA discovered the intrusion around Aug. 1 and isolated the affected systems; Valve said it learned of the likely compromise Aug. 7 and sent its first customer notice Aug. 10, with the follow-up arriving about five weeks later. CEVA has said its cybersecurity teams activated their protocols and launched an investigation as soon as the incident was identified.

The breach extended beyond Valve. In August, several other companies, including Dutch department store De Bijenkorf, online retailer bol, soccer club Ajax, financial institution ING, optician chain Ace & Tate and the Pokémon Center, told customers their personal information was likely stolen in the same CEVA incident, and 10 organizations reported related incidents to Dutch data protection authorities. CEVA also said personal information belonging to current and former employees, including identification numbers, Social Security numbers, bank details, family information, salary data and absence records, was stolen separately.

Valve’s original notice said any exposed data would have been limited to delivery-related information CEVA holds for Steam hardware orders, such as a customer’s name, address, phone number, the email tied to their Steam account, and the type and price of the hardware ordered, rather than account credentials or payment details, which are not stored in CEVA’s systems.