Valve Notifies European Steam Hardware Buyers After CEVA Logistics Cyberattack Exposed Personal Data

Valve began notifying European customers who ordered Steam hardware that their personal information may have been exposed after a cyberattack on CEVA Logistics, the company that handles Steam hardware deliveries across the region.

“Valve said the attack on CEVA occurred between July 29 and August 1”

GamesIndustry.biz

In the notification email seen by GamesIndustry.biz, Valve said the attack on CEVA occurred between July 29 and August 1, and that it learned of the breach on August 7.

A 90s Kid

Valve said CEVA retains delivery-related data for up to 90 days after an order is placed, and that it was notifying everyone it believes was affected within that window.

The compromised information includes customers' names, street addresses, postal codes, cities, countries, phone numbers, the email addresses tied to their Steam accounts, and the type and price of the hardware ordered.

Valve insisted that no payment information, passwords, Steam Guard codes or other account data were affected, and it told customers they don't need to change their passwords or account settings.

Valve warned affected Steam hardware buyers to expect phishing attempts via email, SMS, or phone that reference their order and may quote a customer's real address to appear legitimate.

In Valve’s message, the company said, "They may quote your address back to you to prove they're genuine," and it added that customers should treat the communications as fake.

BleepingComputer

BleepingComputer reported that Valve told customers that no additional information related to the Steam account or other purchases was impacted because CEVA does not have access to payment information, passwords, Steam Guard codes, or other sensitive data.

GamesIndustry.biz also said Valve reiterated that Steam Support only operates through help.steampowered.com and will never request a password or Steam Guard code.

The incident was tied to CEVA’s contract logistics operations, with CEVA confirming the breach in a statement to TechCrunch and saying the intrusion affected part of its European contract logistics operations.

CEVA’s disruption was described as contained to eight European warehouses, with Valve’s notifications arriving after CEVA informed multiple European retailers on August 1 that a cyberattack disrupted operations at those sites.

“El ataque afecta a ocho almacenes en Europa”

DiarioBitcoin

DiarioBitcoin said the breach exposed data for customers of banks, minoristas, and Steam, naming Bol, De Bijenkorf, Ajax, ING, Ace & Tate and Valve, and it stated that the intrusion began the 29 de julio and affects 8 almacenes.

Breakbulk.News reported that bol suspended data exchanges with its logistics partner and temporarily removed products stored at affected locations from sale, while De Bijenkorf warned that processing of orders, returns, and refunds could take longer than normal.

BleepingComputer added that CEVA Logistics operates 1,000 warehouses and handled 15 million shipments last year, and it said Valve’s disclosure came after CEVA told retailers about the warehouse disruption.

As Valve pressed CEVA for further detail and said it was notifying data protection authorities in the affected countries, the exact number of customers affected remained undisclosed in the coverage.