The attack gave intruders access to CEVA systems between July 29 and August 1, 2026. Valve learned on August 7 that information belonging to its customers was among the data potentially compromised. The gaming company has since begun sending breach notifications to people whose hardware orders placed them within the affected group.
The exposed information can include customers’ names, delivery addresses, telephone numbers and email addresses. Details identifying the type and price of Steam hardware ordered were also potentially taken. That combination creates a particular phishing risk because criminals could use authentic delivery information to make fraudulent communications appear convincing.
Payment information, Steam passwords and Steam Guard authentication codes were not exposed through CEVA, Valve said. The logistics provider does not receive those details when processing hardware deliveries. Other Steam account information and purchases unrelated to the affected shipments were also outside the compromised delivery records.
CEVA keeps the delivery information supplied by Valve for as long as 90 days after an order. The retention period allows the logistics company to handle returns and other fulfilment problems. Valve therefore contacted customers whose orders may have remained within CEVA’s systems when the intrusion occurred, rather than limiting warnings only to buyers whose information has been individually confirmed as stolen.
Valve cautioned customers to expect fraudulent emails, text messages and telephone calls referring to their Steam hardware purchases. Attackers could impersonate Valve, Steam or delivery companies and use a genuine address, telephone number or order detail to establish credibility.
Such messages could demand small customs charges, additional delivery payments or redelivery fees. Others may direct customers towards fake websites designed to collect Steam credentials or financial information. Valve told customers that the CEVA incident does not require them to change Steam passwords or alter account settings because the compromised systems did not contain those credentials.
The company also reminded users that Steam Support handles account matters through its official support service and will not ask customers to disclose passwords or Steam Guard codes. The warning reflects the danger posed by breaches involving seemingly routine shipping data. Personal details combined with information about an actual purchase can make targeted social-engineering attempts harder to identify than generic phishing campaigns.
The CEVA intrusion extends beyond Valve. The logistics group said the cyberattack affected part of its European contract logistics operations and disrupted eight warehouses. Companies whose products move through CEVA facilities have reported exposure of customer shipping information and operational delays linked to the incident.
Among organisations affected are online retailer Bol, department store De Bijenkorf, football club Ajax, banking group ING and eyewear company Ace & Tate. The cases underline the potential reach of an attack on a logistics provider serving multiple businesses from shared infrastructure. CEVA operates more than 1,000 warehouses globally and generated $18.3 billion in revenue in 2025.
CEVA said it activated security procedures after identifying the intrusion and began an investigation. The company said the operational effects were limited to the eight European warehouses and that its other systems worldwide continued operating normally. Some affected services have subsequently been restored.
Valve said CEVA had isolated the systems involved, taken compromised infrastructure offline and brought in outside investigators. Valve is also seeking further information from its logistics partner to determine the full scope of the theft and how the attackers gained access.
Data protection authorities in affected European jurisdictions are being notified. The incident may attract scrutiny over the volume of customer information held by third-party fulfilment companies and the controls surrounding data shared between retailers, technology companies and logistics contractors.
The breach comes as Valve expands its physical hardware business beyond the Steam Deck. The company has been taking reservations for newer Steam hardware, including its Steam Machine and Steam Controller, increasing the volume of customer information passing through fulfilment partners serving European buyers.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
