Valve notifies Steam hardware customers of a data breach
Valve notifies European Steam hardware customers of data breach via shipping partner CEVA Logistics.
Valve is alerting European Steam hardware customers about a data breach that occurred at its shipping partner, CEVA Logistics. Hackers accessed CEVA's systems between July 29 and August 1, 2026, stealing customer names, addresses, phone numbers, and email addresses. Valve emphasizes that no Steam account or payment information was compromised, but warns customers of potential phishing attacks using the stolen data.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Valve?
Get an email when a new story names Valve, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonValve's data breach originated not within its own systems, but at a third-party shipping partner, CEVA Logistics — a classic supply chain security failure. Attackers accessed CEVA's systems over a four-day window, exfiltrating personally identifiable information (PII) including names, addresses, phone numbers, and email addresses. This incident highlights how an organization's security posture is only as strong as its weakest vendor link, and that customer data shared with partners inherits the risk profile of those partners. Even when core systems like payment platforms remain uncompromised, stolen PII creates significant downstream risk through targeted phishing and social engineering campaigns.
What helps against this
How we list vendors- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.