Valve Customer Data Exposed in CEVA Logistics Cyberattack

Valve’s logistics partner, CEVA Logistics, has been hit by a cyberattack, granting unauthorized actors access to the personal data of customers purchasing devices in Europe. Valve has alerted customers to the increased risk of phishing attacks, urging them to exercise extreme caution regarding delivery notifications.

Incident Details and Exposed Data

According to Valve, unauthorized access to the contractor’s systems was detected between July 29 and August 1, with Valve receiving notification of the incident on August 7. Hackers accessed customer information held for order fulfillment purposes (CEVA typically retains this data for up to 90 days).

The compromised data includes:

• Customer names
• Email addresses
• Phone numbers
• Shipping addresses
• Order contents
• Order costs

It is important to note that Steam account passwords, payment details, and Steam Guard two-factor authentication codes remain secure and were not compromised during this attack.

Phishing Risks and Safety Measures

Valve is officially warning its European customers about heightened malicious activity. Users should remain vigilant against phishing attempts via email, SMS, or phone calls, where attackers may impersonate delivery services or Valve representatives. The primary goal of such attacks is to coerce users into paying fake customs duties, delivery fees, or to lure them to malicious phishing websites.

Valve’s expert recommendations:

• Never click links in suspicious emails.
• Always manually enter official addresses (help.steampowered.com, store.steampowered.com) into your browser.
• Use the official desktop Steam client.
• Remember that official support will never ask for your password or Steam Guard code in personal correspondence.

CEVA Logistics has currently isolated the affected systems and engaged third-party security experts to conduct a detailed investigation. Relevant data protection authorities have been promptly notified of the incident.

While the breach at the third-party logistics provider did not impact Steam accounts or payment information, the stolen details are sufficient for sophisticated phishing campaigns. European Valve customers should be especially cautious regarding delivery-related communications and must never disclose their passwords or Steam Guard codes to third parties.