Skip to content
Tech News
← Back to articles

Data of European Steam hardware customers 'likely compromised', Valve says

read original more articles
Why This Matters

The recent data breach involving European Steam hardware customers highlights the ongoing risks of cyberattacks targeting logistics partners, emphasizing the importance of data security in the gaming and tech industries. While sensitive payment information remains secure, exposed personal data could lead to targeted scams, underscoring the need for consumer vigilance. This incident serves as a reminder for companies to strengthen supply chain security and for consumers to stay alert to potential phishing attempts.

Key Takeaways

Any Steam hardware owners in Europe should be on the lookout for scam messages in the near future after Valve said that personal data of some of its customers were exposed in a cyberattack. In an email sent out to affected customers, Valve said that a company that ships its Steam hardware products to its European users, called CEVA Logistics, was hit with a data breach between July 29 and August 1. Valve said it learned on August 7 that the cyberattack led to some personal information about Steam customers being "likely compromised."

According to Valve, the stolen information includes names, addresses, phone numbers, emails and order details. However, the company clarified that CEVA doesn't have access to customers' payment info, passwords, Steam Guard codes or any other similar sensitive info. Valve added that affected users don't have to change their Steam passwords or account details.

Looking ahead, Valve warned in the email that some customers can "expect fake messages — email, SMS or phone — that mention your hardware order and appear to come from Steam, Valve or a delivery company." Valve said that these fake messages might use sensitive info like addresses or order details to convince you to pay for a small customs or redelivery fee, or even sign into something to verify the order. Valve said it's "pressing CEVA for the full scope of what was taken and how," adding that it was "in the process of notifying the data protection authorities in the countries affected."