CEVA Logistics, which helps Valve distribute its hardware across the continent, suffered a breach on 7th August. The company later notified Valve, who’s now warning players.
Thankfully, the compromised data doesn’t include passwords or payment details. However, they may include names, addresses, phone numbers, countries of residence, and Steam account email addresses. Crucially, the leaked information may also contain Steam hardware purchase details of affected users.
Using some or all of that information, malicious actors could create legitimate-looking shipment emails and send them to customers who they know will be expecting a message from Valve.
“Expect fake messages – email, SMS or phone – that mention your hardware order and appear to come from Steam, Valve or a delivery company,” Valve told customers in a note (via Digital Foundry).
“They may quote your address back to you to prove they’re genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to ‘verify’ your order. Treat all of them as fake.”
Valve added that CEVA continues to investigate the attack, so while you may not end up being contacted by people trying to take advantage of the situation, it’s obviously worth being on guard.
“CEVA receives specific delivery-related information from Steam to be able to ship physical hardware to customers in Europe,” Valve explained. “Because CEVA retains this information for up to 90 days after that order, we are sending this message to all customers we can assume were impacted.”
Valve further added that it’s “pressing CEVA for the full scope of what was taken and how”. The company also confirmed it’s contacting data protection authorities in affected countries.
For the last couple of months, Valve has been shipping Steam Machines to customers who won its pre-order lottery. Steam Controllers continue shipping, too, but ordering one today won’t get you anything until sometime in 2027.
