Steam hardware shipper breach leaks customer data, including names and addresses

Valve says a data breach may have exposed the personal information of customers who ordered its Steam hardware in Europe. In an email sent to users, Valve says its European shipping partner, CEVA Logistics, suffered a data breach that may have included customer names, addresses, phone numbers, and email addresses.

The breach at CEVA occurred between July 29th and August 1st, weeks after Valve began taking reservations for its new Steam Machine and Steam Controller. Valve adds that European customer data “was likely compromised” as part of the breach, as CEVA stores “delivery-related information” for up to 90 days after orders.

As a result of the breach, Valve says to “expect fake messages” over email, text, or on the phone that claim to come from Steam, Valve, or a delivery company. “They may quote your address back to you to prove they’re genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to “verify” your order,” Valve says. “Treat all of them as fake.”

The notice says additional data linked to users’ Steam accounts or purchases wasn’t impacted, adding that CEVA “does not have access to your payment information, passwords, Steam Guard codes or other information.” Valve notes that it only deals with account issues from help.steampowered.com, and won’t contact users over email, Steam chat, or Discord.