Valve has warned that some European customers who bought Steam hardware may have had their delivery information compromised after a cyberattack on CEVA Logistics, its regional shipping partner. The incident matters because the exposed details could be used for targeted phishing, scam calls or other fraud, although Valve itself was not reported to have been breached.

The attack took place between 29 July and 1 August, and Valve learned on 7 August that customer data may have been taken. CEVA retains delivery information for up to 90 days, so Valve is contacting potentially affected customers; the data includes names, addresses, phone numbers, Steam-linked email addresses, and the type and price of hardware ordered, but not other Steam account or purchase information.