Earlier this morning, Valve began contacting customers who have purchased Steam hardware in Europe to notify them that one of its regional shipping partners, CEVA Logistics, was the subject of a recent cyberattack that "likely" exposed their personal information.
In its email—shared by notified users on Reddit and elsewhere—Valve said the attack took place sometime between July 29 and August 1, 2026. The company explained that the attackers targeted "specific delivery-related information" that Valve provides to CEVA Logistics in order to fulfill hardware orders for European customers, which the France-headquartered shipping company retains "for up to 90 days after that order."
English (US)