Valve has begun notifying recent Steam hardware customers of a personal data breach that may have exposed their name, address, phone number and email.
Anyone who purchased a Steam Deck, Steam Machine, or Steam Controller within Europe over the past 90 days may have potentially been impacted, Valve has said, though passwords and payment details are not thought to be at risk.
Hackers are believed to have gained access to systems held by CEVA Logistics, the European distribution firm used by Valve to ship Steam hardware across the continent. Valve says it shares “specific delivery-related information from Steam” with CEVA, which are “the details the attacker likely took.”
“Because CEVA retains this information for up to 90 days… we are sending this message to all customers we can assume were impacted,” Valve wrote, in an email to customers shared more widely via reddit, cautioning that customer names, addresses, phone numbers, email addresses and purchase details were likely compromised.
“Expect fake messages — email, SMS or phone — that mention your hardware order and appear to come from Steam, Valve or a delivery company,” Valve cautioned. “They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to ‘verify’ your order. Treat all of them as fake.”
Valve said it was now “pressing CEVA” for more details and notifying data protection authorities, and warned customers to remain vigilant over the days and weeks to come. There is no need to change Steam passwords, however, or modify any other account settings.
Last month, it was reported that Steam Deck sales had cratered by up to 82% following this year’s price rises. “At its new price of $789, the Steam Deck is straight up a worse deal than some of its competitors like the Xbox Ally or the Lenovo Legion Go S,” IGN recently wrote, “unless you’re really attached to the Deck’s haptic trackpads.”
Tom Phillips is IGN’s News Editor. You can reach Tom at tom_phillips@ign.com or find him on Bluesky @tomphillipseg.bsky.social
