A cyberattack on August 7 targeting CEVA Logistics, Valve's European distribution partner, has compromised the personal data of customers who purchased Steam hardware. While Valve's own servers remain secure, the leak creates a significant opening for targeted social engineering attacks.

Psst!Add AlexTech.ai asPreferred Source on Google

Exposed Data and Targeted Phishing Risks

The breach did not impact passwords or payment methods. However, names, physical addresses, phone numbers, and Steam account emails were stolen. Crucially, the theft of specific hardware purchase details allows attackers to craft highly convincing fraudulent messages that appear legitimate by referencing actual order history.

Common Scam Tactics

As reported via Digital Foundry, malicious actors may contact users via email, SMS, or phone. They are expected to request small customs fees, redelivery charges, or ask users to sign into fake portals to "verify" their orders. Valve urges customers to treat all such requests as fraudulent, even if the sender quotes correct personal details.

Incident Response and Scope

Because CEVA retains shipping data for 90 days post-purchase, Valve has notified all potentially affected customers within that window. The company is currently coordinating with data protection authorities across Europe and demanding a full audit from CEVA regarding the scope of the stolen information.

This breach highlights ongoing vulnerabilities in hardware supply chains, mirroring recent trends where legacy BMC controller bugs have exposed thousands of corporate servers to remote backdoors.