European gamers eagerly awaiting their Steam Machines and Steam Controllers are facing a new hurdle: highly targeted phishing attacks. Valve has issued an urgent warning to its hardware customers following a significant data breach at its European distribution partner, CEVA Logistics.
The cyberattack, which occurred on August 7, compromised the systems of CEVA Logistics, the company responsible for distributing Valve's physical hardware across the continent. While Valve confirmed that its own servers remain completely secure, the logistics partner's breach exposed sensitive customer information retained for shipping purposes.
Fortunately, the compromised data does not include passwords or payment details. However, malicious actors did gain access to names, physical addresses, phone numbers, countries of residence, and Steam account email addresses. Crucially, the leaked database also contains specific Steam hardware purchase details, giving attackers the exact context needed to craft convincing scams.
Expect fake messages - email, SMS or phone - that mention your hardware order and appear to come from Steam, Valve or a delivery company.
- Valve
How to Spot the Fake Shipment Scams
Because attackers know exactly what hardware you ordered and where you live, their phishing attempts will look highly legitimate. Valve advises customers to watch out for the following tactics:
- Attackers may quote your exact home address to build false trust.
- Scammers might request a small "customs fee" or "redelivery charge" to release your package.
- Phishing links may ask you to sign in to a fake portal to "verify" your hardware order.
Valve is currently pressing CEVA Logistics to determine the full scope of the stolen data and the method of the breach, while also notifying data protection authorities in the affected countries. Because the shipping company retains delivery data for up to 90 days, Valve is proactively contacting all potentially impacted users. This security headache arrives as Valve continues fulfilling pre-orders for Steam Machines, while new orders for Steam Controllers face shipping estimates stretching into 2027.
The Supply Chain Vulnerability
This breach highlights a growing blind spot in gaming hardware security: the physical supply chain. While tech giants invest heavily in securing their digital storefronts and user databases, third-party logistics providers remain a lucrative target for threat actors. By stealing shipping manifests rather than credit card numbers, hackers can execute highly effective spear-phishing campaigns.
Gamers are particularly vulnerable in this scenario. The sheer anticipation of receiving backordered hardware - especially items facing massive delays - makes buyers far more likely to click a fraudulent tracking link or pay a fake customs fee without a second thought. Moving forward, hardware manufacturers will need to enforce stricter data retention policies on their shipping partners to minimize the blast radius of these inevitable logistics breaches.
