Valve Steam Hardware Orders Exposed After Cyber Attack

People who bought Steam hardware are being told that CEVA Logistics, Valve's logistics partner, was hacked. Names, addresses, phone numbers, email addresses, and information about the hardware purchased may have been made public, along with delivery information for hardware orders.

Valve has announced that its logistics partner CEVA Logistics was hit by a cyber attack. The attack happened between July 29 and August 1, and Valve says it learned on August 7 that some customers' delivery information may have been compromised.

Valve Warns Customers About the Cyber Attack

The potential information includes a customer's name, street address, city, postal code, country, phone number, email address linked to the Steam account, and the type and price of the hardware ordered. That means the people behind the attack could potentially know who ordered Steam hardware, where it was being delivered, how to contact the customer, and what hardware was purchased.

Valve says payment information, passwords, Steam Guard codes, and other Steam account information were not affected by the incident. The attack appears to have involved CEVA Logistics rather than Steam or Valve directly.

CEVA Logistics handles shipping and order processing, so Valve has to share certain customer information with the company to process hardware deliveries. The incident shows how customer data can still be exposed when a third-party company handling that information is attacked.

Leaked Delivery Data Could Lead to Scams

A scammer could ask customers to confirm their delivery, pay a fake customs or redelivery fee, or log in through a fake Steam website. Because the leaked information could include details about an actual hardware order, these messages may look more believable. If you recently ordered a Steam Deck, Steam Machine, or other Steam hardware, you could receive a message that appears to match a real delivery.

A scammer could use the order information to make the message look legitimate. That is why it is important to take a little more time before clicking anything. If an email asks for payment, account information, delivery confirmation, or a login, investigate it before doing anything.

Scammers often use email addresses that have nothing to do with the company they claim to represent. An address that looks like a random Gmail account or an unfamiliar domain should immediately raise suspicion. If an email claims to be from Valve, check the sender carefully.

Do not assume that a message is legitimate simply because it contains information about a Steam hardware order. If you receive a suspicious message about a Steam hardware delivery, do not click its links. Instead, go directly to the official Steam support website and check the relevant information there.

Steam Account Passwords Do Not Need to Be Changed

Valve says affected customers do not need to change their Steam password or account settings because the incident did not affect Steam account information. The concern is mainly around delivery and order information. However, that information can still be useful to scammers attempting to trick customers into handing over their Steam credentials.

A fake delivery message could claim that there is a problem with an order and ask you to log in to confirm an address. The link could lead to a clone of the Steam website designed to collect your login details. Once scammers obtain those credentials, they could attempt to take over the account or use the account for other purposes. Customers who have reserved hardware could also face similar risks. For example, someone waiting for a Steam Controller could receive an email claiming that the order is ready for payment.

In that situation, you should verify everything before making a payment. Do not rely on an email alone to confirm that a purchase request is genuine. The same applies to tracking numbers and delivery updates. If something does not look right, check the order directly through Steam rather than following a link provided in a message.

The attack is a warning for anyone who has purchased or ordered Steam hardware.

The leaked information does not appear to include passwords or payment details, but names, addresses, phone numbers, email addresses, and hardware order information can still be used in targeted scams. The safest approach is to access Steam directly instead of using links contained in unexpected emails or messages.

Valve's warning appears to apply to European Steam hardware customers, while US customers are not affected by this incident. For affected customers, the main priority is staying alert to potential phishing attempts.

The leaked delivery information could give scammers enough context to make fake messages appear connected to a real Steam hardware purchase. The payment and Steam account information remain unaffected, but customers should still double-check emails, tracking messages, and payment requests related to their hardware orders.