Valve has warned customers who ordered its new Steam Machine and Steam Controller hardware in Europe that a data breach at its shipping partner may have exposed their personal information. The breach occurred at CEVA Logistics, which handles Valve's European deliveries, and matters because it leaves affected customers vulnerable to convincing phishing attempts from scammers who may already possess their real delivery details.

The breach at CEVA took place between 29 July and 1 August, shortly after Valve opened reservations for the two new devices, and may have exposed customers' names, addresses, phone numbers and email addresses. Valve says CEVA retains delivery-related data for up to 90 days after an order, and stressed that no Steam account data, payment details, passwords or Steam Guard codes were affected. The company has urged customers to treat any messages claiming to be from Steam, Valve or a courier as fake, noting that scammers may quote back real addresses to appear legitimate, and confirmed it will only ever handle account issues via help.steampowered.com.