Valve warns European Steam hardware customers their data may have been stolen in a cyberattack on logistics partner

Valve

Valve has begun notifying Steam hardware customers in Europe that their personal data was likely compromised after a cyberattack hit CEVA Logistics, the company it uses to ship physical hardware orders across the continent. The breach occurred between July 29 and August 1, with Valve learning of it on August 7.

The details:

As confirmed by Valve in an email to customers (via Reddit), CEVA Logistics, a subsidiary of CMA CGM (the world's third-largest shipping company), had servers accessed by attackers over a four-day window. Eight European warehouses were disrupted, and CEVA notified affected retailers on August 1 before Valve was informed on August 7.
The data likely stolen includes names, street addresses, postal codes, cities, countries, phone numbers, email addresses, and the type and price of ordered hardware. CEVA retains this information for up to 90 days after an order, so Valve is notifying everyone who falls within that window.
Valve confirmed that no Steam account data was affected. CEVA does not have access to payment information, Steam passwords, Steam Guard codes, or any other account-level details. Users do not need to change their passwords or adjust account settings.
Valve's notification email warned customers directly to expect phishing attempts: "They may quote your address back to you to prove they're genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to verify your order. Treat all of them as fake."
Valve says it is pressing CEVA for the full scope of what was taken and how, and has begun notifying data protection authorities across the affected countries. CEVA has isolated the affected systems and brought in outside investigators.

Interested in cybersecurity and trust and safety roles in games? Find opportunities with a Free Hitmarker Profile.