Valve has confirmed that a cyberattack on CEVA Logistics, the company that ships Steam hardware to buyers across Europe, exposed the personal data of customers who ordered a Steam Deck, Steam Controller, or Steam Machine. The company told affected users on Valve learned of the incident on August 7, 2026, and said CEVA systems were accessed between July 29 and August 1, with names, addresses, phone numbers, and Steam-account-linked email addresses potentially exposed during that window. Valve said payment details, passwords, and Steam Guard codes were not touched.
The disclosure, reported publicly on August 10 by Help Net Security, TechCrunch, and BleepingComputer — all three confirming Valve’s account that zero payment details, passwords, or Steam Guard codes were accessed — makes Valve the highest-profile name on a growing list of CEVA clients caught up in the incident, a list that also includes Dutch retailer Bol, luxury department store De Bijenkorf, Amsterdam football club Ajax, and banking giant ING. For a storefront that has spent two decades building trust with PC gamers, the Steam data breach is a blunt reminder that platform security now hinges on vendors most players have never heard of — and it isn’t the first time Steam users have had reason to worry: on May 14, 2025, cybersecurity firm Underdark reported roughly 89 million Steam accounts, close to two-thirds of the platform’s user base, listed for sale on a dark-web forum for $5,000, a claim tracked by CertPro and outlets like Laptopmag and Marca before Valve clarified the data involved only expired, 15-minute SMS codes and phone numbers rather than any real account compromise.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Inside the CEVA Logistics Attack Timeline
The attack itself ran from July 29 to August 1, 2026, hitting systems at CEVA Logistics, a France-headquartered shipping giant that posted roughly $18.3 billion in 2025 revenue and operates more than 1,000 warehouses worldwide, according to TechCrunch’s reporting. CEVA has said the operational damage was contained to eight of its European warehouses, with no other global systems affected. That containment claim matters, because it is the difference between a regional shipping-data incident and a company-wide compromise.
CEVA began notifying its corporate clients about the breach around August 1. Valve, in turn, emailed affected Steam hardware buyers on August 7, nearly a week later, and the story broke publicly on August 10 once security outlets picked it up. That gap between internal notification and customer disclosure is fairly standard for incidents that require legal review and coordination across multiple affected brands, but it also means European buyers who ordered Steam hardware in the past few months had no way to know their shipping data was exposed until Valve’s email landed.
What Data Was Exposed, and What Valve Says Stayed Safe
Valve’s notice to customers was specific about scope. Exposed fields included names, street addresses, postal codes, cities, countries, phone numbers, the email address tied to a customer’s Steam account, and the type and price of the hardware ordered. Passwords, payment card numbers, and Steam Guard two-factor codes were reported as untouched, according to Help Net Security’s review of the notification, a detail BleepingComputer independently corroborated in its own August 10, 2026 report on Valve’s CEVA breach notice. Valve’s own words, quoted directly in that reporting, were blunt: “Between July 29 2026 and August 1, 2026, a cyberattack hit CEVA Logistics, the company that ships Steam hardware to customers in Europe.”
Valve also warned customers to expect follow-on scams. Because the exposed data includes real names, addresses, and order details, phishing messages that reference a genuine past purchase will look far more convincing than a generic scam email. The company’s guidance was to treat any unsolicited email, text, or phone call referencing a Steam hardware order as fake, regardless of how much personal detail it seems to know. Valve was equally direct that no password reset or Steam Guard change is required because of this incident alone, since account credentials were never in CEVA’s hands to begin with.
Steam Data Breach at a Glance
The table below summarizes what is confirmed about the Steam data breach as of this week, pulled directly from Valve’s customer notice and subsequent reporting.
| Detail | What’s Confirmed |
|---|---|
| Attack window | July 29 – August 1, 2026 |
| Target | CEVA Logistics (Valve’s European hardware shipping partner) |
| CEVA notified clients | Around August 1, 2026 |
| Valve notified customers | August 7, 2026 |
| Public disclosure | August 10, 2026 |
| Warehouses affected | 8 of CEVA’s 1,000+ global sites |
| Region affected | Europe only, per Valve’s notice |
| Data exposed | Name, address, postal code, city, country, phone, Steam account email, hardware type and price |
| Data NOT exposed | Payment details, passwords, Steam Guard codes |
| CEVA data retention window | Up to 90 days after purchase |
| Products referenced | Steam Deck, Steam Controller, Steam Machine |
Why Valve Leans on a Third Party to Ship Steam Hardware
Valve has long run Steam with a famously lean internal team relative to the money the platform generates, a structure that works well for software distribution but doesn’t scale to running warehouses and delivery fleets across dozens of countries. Shipping physical products like the Steam Machine or a Steam Deck to a customer’s door in Berlin, Warsaw, or Lisbon is a logistics problem, not a software one, so Valve does what most hardware sellers do: it contracts a specialist. CEVA fills that role for European orders.
That arrangement is not unusual and, on its own, is not a security failure. The problem is structural rather than a Valve-specific mistake. A single logistics vendor serving hundreds of retail and consumer brands becomes a concentrated target. Compromise one shipping company’s order-management system and you don’t just expose one client’s customers, you expose everyone whose delivery data happens to be sitting in the same systems at the same time. CEVA’s own scale, more than 1,000 warehouses serving clients well beyond gaming, is exactly what turned this into a multi-industry story rather than a Steam-only one.
The Blast Radius: A Football Club, a Bank, and Steam’s Fellow Victims
Valve stands out mainly because of Steam’s size, but it is far from the only brand caught in CEVA’s breach. TechCrunch’s reporting names Dutch e-commerce platform Bol, department store De Bijenkorf, Amsterdam football club Ajax, eyewear retailer Ace & Tate, and banking group ING among the affected organizations. That spread, from a bank to a football club to a game storefront, shows exactly why supply-chain incidents get treated differently than a direct hack of a single company’s own network.
The scale of the regulatory response reflects that spread. The Dutch data protection authority has already received breach notifications from 10 separate organizations tied to the CEVA incident, a figure likely to grow as more affected brands complete their own legal reviews. CEVA has said it isolated the compromised systems, took them offline, and brought in outside investigators, while telling clients the operational impact, things like shipping delays and a handful of canceled orders, stayed limited to the eight affected warehouses.
Third-Party Vendor Risk Is Now the Default Attack Surface
Security researchers have been warning about exactly this pattern for years, and the numbers back up why. Secureframe’s data breach statistics roundup found that “at least 52.4% of breaches involved third parties in 2024, not 36% of all data breaches, up 6.5% year-over-year.” The same research places vendor and supply-chain compromise as “the second most prevalent attack vector and second costliest at $4.91 million” per incident.
The cost gap between internal and vendor-driven incidents isn’t small either. Citing Gartner, Secureframe’s third-party risk statistics report notes that “the average cost of a third-party cyber breach is typically 40% higher than the cost to remediate an internal cybersecurity breach.” Separately, cybersecurity firm Huntress found that “breaches involving third parties increase the total average cost by an estimated $370,000,” and risk-intelligence company SecurityScorecard reported that “retail and hospitality organizations see 52.4% of breaches involved third parties, and while CEVA’s client list includes a retailer, a department store, and a games storefront, that figure is not specifically about CEVA’s client list.
None of that data is specific to gaming, but it explains why a shipping company’s breach can generate bigger headlines than most direct hacks of a single retailer. Valve didn’t lose control of its own systems. It lost control of data the moment it handed that data to a vendor it doesn’t operate.
How the CEVA Breach Stacks Up Against Other 2026 Incidents
2026 has not been short on data breach headlines, in gaming or otherwise. The table below places the Steam data breach alongside other incidents this year and a few of the historical cases that shaped how companies now respond to vendor risk.
| Incident | Disclosed | Root Cause | Scope |
|---|---|---|---|
| CEVA Logistics → Valve/Steam | Aug 10, 2026 | Third-party shipping vendor breach | 8 EU warehouses, 6+ client brands |
| Nintendo internal breach | 2026 | Direct network intrusion | ~859MB stolen, $2M ransom demand |
| Tata Electronics → Apple | 2026 | Contract manufacturer breach | 630GB of Apple supplier data |
| MOVEit Transfer (Cl0p group) | 2023 | Zero-day in file-transfer software | 2,773 organizations, ~95.8M individuals |
| SolarWinds (Sunburst) | 2020 | Trojanized software update | ~18,000 customers exposed, 9 federal agencies |
The comparison matters because it shows two distinct breach patterns converging on the same headline this week. Nintendo’s incident and the Tata Electronics case both trace back to a single organization’s systems being pierced directly or through a manufacturing partner. CEVA’s breach, like MOVEit and SolarWinds before it, comes from a shared piece of infrastructure serving many unrelated companies at once, which is why the CEVA Logistics data breach touched a bank, a football club, and a game storefront in the same week.
Steam’s Trust Ledger in 2026
The CEVA incident lands in the middle of an already rough stretch for platform trust across the gaming industry. Sony has spent 2026 fielding repeated PSN outages and a $457 million PlayStation Store lawsuit. Valve itself is heading toward trial in an antitrust case brought by 32,000 developers challenging Steam’s cut of PC game sales, and in March 2026 the FBI disclosed its own probe into eight malware-infected games that had been uploaded to Steam between May 2024 and January 2026. Not all of those cases involve customer data directly, but they add up to a year where the platforms gamers rely on most have repeatedly had to answer for something other than shipping new features.
What makes the Steam data breach different from those other stories is that it isn’t really about Valve’s own conduct. Steam’s hardware business, including the Deck, the Controller, and the newer Steam Machine, has grown enough that Valve’s own hardware survey data now gets treated as an industry bellwether. Growth on that scale means more customers with shipping addresses sitting in more third-party systems, and more exposure the next time one of those systems gets hit.
What Security Experts Say Steam Hardware Buyers Should Do Now
Valve’s own guidance is narrow by design: no password change, no Steam Guard reset, just heightened suspicion of anything referencing a recent hardware order — the same line the company took on May 14, 2025, when it told PCGamesN and Mashable directly that none of the 89 million SMS records for sale were tied to actual passwords or payment data, since the codes had already expired after their original 15-minute window. That advice lines up with how security teams generally recommend handling a shipping-data exposure rather than a credential leak, since the attackers here got mailing information, not the keys to anyone’s account. The bigger risk sits in the weeks after disclosure, when scammers try to exploit the news cycle itself.
Steam hardware breach: phishing red flags to watch for
- Unsolicited email, SMS, or phone call that references your name, address, or a past order
- Any link asking you to "verify" your Steam password or a Steam Guard code
- Urgent language about a "held," "delayed," or "compromised" shipment
- A request for payment card details to "confirm" a hardware order you already paid for
- Sender addresses that mimic steampowered.com, valvesoftware.com, or CEVA using lookalike domains
Valve's guidance: treat all of the above as fake. No password or Steam Guard change is required because of this incident alone.Anyone who ordered Steam hardware for delivery in Europe in the past few months and wants to double-check general exposure can also run their email through a breach-monitoring service like Have I Been Pwned, though CEVA’s shipping data hasn’t been reported as posted to public breach-index sites as of this writing. For anything that looks like a scam attempt tied to this incident, the FBI’s Internet Crime Complaint Center and equivalent national agencies remain the right place to report it.
Regulatory Fallout: GDPR Notifications and the Dutch Data Protection Authority
Because CEVA’s affected warehouses and most of its named clients sit in Europe, this breach falls squarely under GDPR’s breach notification rules, which generally require companies to report qualifying incidents to a data protection authority within 72 hours of becoming aware of them. The Dutch Autoriteit Persoonsgegevens has confirmed it already received reports from 10 organizations connected to the CEVA breach, and Valve has said it is notifying data protection authorities in every affected country, not just the Netherlands.
That multi-country notification process is one reason vendor-driven incidents like this tend to generate slow-rolling news coverage rather than a single dramatic announcement. Each affected brand runs its own legal review, notifies its own regulators, and emails its own customers on its own timeline, which is exactly why Bol, Ajax, ING, and Valve all disclosed on different schedules despite being hit by the same underlying attack on CEVA.
Market Impact: Does This Dent Valve’s Grip on PC Gaming?
Steam still controls an estimated 74% of PC digital game sales, a lead built on network effects (friends lists, achievements, a library people don’t want to rebuild elsewhere) that a shipping-vendor breach is unlikely to shake on its own. The Steam data breach differs in kind from a core platform hack. No Steam accounts were compromised, no game libraries were touched, and the exposed information is the kind of shipping data that has, at various points, leaked from countless online retailers without triggering any mass account migration.
Where it could matter is narrower and more specific: Steam’s hardware line. Buyers considering a Steam Machine or a Steam Deck purchase now have one more data point suggesting that ordering physical Valve hardware, unlike simply buying games on Steam, means handing shipping details to a vendor outside Valve’s direct control. That’s unlikely to crater hardware sales, but it’s the kind of story that shows up in comment sections the next time Valve announces a new device.
From SolarWinds to CEVA: The Rise of Supply-Chain Breaches
The CEVA incident fits a pattern security teams have tracked since at least 2020, when the SolarWinds Sunburst attack showed how a single trojanized software update could ripple into an estimated 18,000 customer organizations, including nine confirmed U.S. federal agencies. The 2021 Kaseya VSA ransomware attack extended that lesson to managed service providers, with reports at the time describing up to 1,500 downstream businesses affected through a relatively small number of compromised MSPs.
The 2023 MOVEit Transfer breach, driven by the Cl0p ransomware group exploiting a zero-day in file-transfer software, remains the starkest example. Emsisoft’s tracking put the eventual toll at 2,773 organizations and roughly 95.8 million individuals. What connects that incident to CEVA’s is the mechanism, not the industry. A single vendor sitting underneath dozens or hundreds of client companies turns one intrusion into a multi-brand event. CEVA extends that lesson from software supply chains into physical logistics, proving the pattern isn’t limited to code.
Competitive Comparison: How Xbox, PlayStation, and Nintendo Handle Hardware Data
Valve isn’t the only platform holder that ships hardware directly to consumers. Sony runs PlayStation Direct, Microsoft sells consoles and accessories through its own Microsoft Store, and Nintendo operates the My Nintendo Store, all of which require some version of the same shipping pipeline that just exposed Steam buyers’ data. None of the three has disclosed a comparable logistics-vendor breach in 2026, but none of them has published details about exactly which shipping partners handle their direct-to-consumer orders either, so it’s hard to say whether they’re structurally safer or simply haven’t been targeted yet.
What’s clear is that every major platform holder has had its own 2026 trust stumble, just not the same kind. Sony has dealt with PSN reliability complaints and a store-pricing lawsuit. Valve is fighting an antitrust case over its marketplace cut. Now Valve also becomes the platform holder whose hardware customers had shipping data exposed through a vendor. None of these incidents are equivalent, but together they show that scale, whether measured in players, developers, or hardware units shipped, comes with a wider set of ways for platform trust to erode.
5 Predictions for Platform Security After the CEVA Breach
- More CEVA clients will disclose. With 10 organizations already reporting to the Dutch DPA and CEVA serving over 1,000 warehouses globally, expect additional brands beyond Bol, De Bijenkorf, Ajax, ING, Ace & Tate, and Valve to confirm exposure in the coming weeks.
- Valve will face pressure to name its full logistics roster. Expect developer and player communities to push Valve for more transparency about which vendors handle Steam hardware shipping outside Europe, not just confirmation after a breach.
- Rival platform holders will quietly audit their own shipping vendors. Sony, Microsoft, and Nintendo have direct-to-consumer stores with similar exposure, and a competitor’s breach is typically the trigger for internal vendor-risk reviews industry-wide.
- Phishing attempts referencing this breach will spike for months. Valve’s own warning about scam messages suggests the company expects a wave of lookalike-domain attacks aimed at Steam hardware buyers well into late 2026.
- This won’t be the last gaming-adjacent vendor breach in 2026. Third-party compromises now account for over a third of all breaches industry-wide, and gaming platforms increasingly rely on the same cloud, payment, and logistics vendors as every other consumer business, so another platform-adjacent vendor incident before year’s end is a reasonable bet.
Frequently Asked Questions
What is the Steam data breach and when did it happen?
It’s a data exposure at CEVA Logistics, the company that ships Steam hardware to European customers, not a hack of Steam’s own servers. The attack on CEVA ran from July 29 to August 1, 2026. Valve notified affected customers on August 7, and the incident became public news on August 10.
Did hackers get my Steam password or payment information?
No. Valve has said payment card details, account passwords, and Steam Guard two-factor codes were not exposed, because CEVA never had access to that information in the first place. The exposed data is limited to shipping and order details.
Which Steam hardware products are involved?
Reporting on the breach references Steam Deck, Steam Controller, and Steam Machine orders shipped through CEVA in Europe. Valve’s notice covers customers whose hardware orders fell within CEVA’s 90-day data retention window.
Is the Steam data breach limited to Europe?
Based on Valve’s notice and current reporting, yes. CEVA ships Steam hardware to European customers specifically, and the eight affected warehouses are described as European sites. There’s no confirmed reporting of exposure tied to non-European Steam hardware orders.
What should I do if I recently bought Steam hardware in Europe?
Watch for phishing attempts that reference your name, address, or order details, and treat any such message as fake, even if it looks convincing. Valve says no password or Steam Guard change is required. If you receive a suspicious message, report it to your national cybercrime authority rather than clicking any links in it.
Is this breach Valve’s fault?
The intrusion happened inside CEVA Logistics, a third-party vendor, not inside Valve’s own systems. That distinction matters technically, but it doesn’t erase Valve’s responsibility to vet the vendors it hands customer data to, which is precisely the debate playing out across the cybersecurity industry as third-party breaches climb toward accounting for over a third of all incidents.
How does this compare to other 2026 data breaches?
It’s smaller in scope than incidents like the 24-billion-credential leak reported earlier in 2026, and it exposes less sensitive data than breaches involving passwords or financial records. It’s also a different animal from Steam’s other recent security headlines, including the May 14, 2025 reports — covered at the time by PCGamesN, Laptopmag, Marca, and DataBreach.com — of 89 million accounts allegedly for sale for $5,000 (which Valve traced to expired 15-minute SMS codes, not a genuine account breach) and the FBI’s March 2026 probe into eight malware-infected Steam games, since those centered on account security and malicious uploads rather than a shipping vendor’s systems. What sets the CEVA incident apart is the shared-vendor structure, which links Valve’s exposure directly to breaches at a bank, a retailer, and a football club through the same root cause.
Will Valve compensate affected customers?
Neither Valve nor CEVA has announced a compensation program as of this writing. Regulatory scrutiny from the Dutch data protection authority and other European bodies is ongoing, and any compensation decisions would likely follow the outcome of that review rather than precede it.
