Valve warns Steam Machine and Steam Controller buyers in Europe to expect fake messages after logistics partner got hacked

Q: How can customers contact Valve or the designated contact point if they have questions about the breach?

Customers can reach Valve through its support site at help.steampowered.com. The designated contact point for the breach is Artana Digital GmbH in Hamburg.

Q: What steps has Valve reported taking in response to the CEVA breach (e.g., notifications, isolating systems, pressing CEVA)?

Valve says it has begun contacting affected customers directly and is in the process of notifying data protection authorities across affected countries. It reports isolating the affected CEVA systems and is pressing CEVA for the full scope of what was taken. Valve also reminded customers how Steam Support communicates and provided contact points, including its support site and the designated contact, Artana Digital GmbH in Hamburg.

Payment details and passwords are confirmed safe, but names, addresses, phone numbers, and Steam email addresses were likely taken in the breach.

VIEW GALLERY - 3

Hassam Nasir

Tech Reporter

Published Aug 11, 2026 5:04 PM CDT

1 minute & 15 seconds read time

TL;DR: Valve warns European Steam Machine and Controller buyers that CEVA Logistics was hacked; names, addresses, phone numbers, Steam account emails, and order details were likely exposed, while payments, passwords, and Steam Guard codes remain safe. Expect phishing via email, SMS, or calls; Valve advises using official support channels only.

Voice: Hassam NasirSpeed

0:00 / 2:29

Valve has issued a warning to Steam Machine and Steam Controller customers in Europe after its logistics partner, CEVA Logistics, suffered a cyberattack between July 29 and August 1. CEVA notified Valve on August 7, and Valve has since begun contacting affected customers directly.

The breach did not touch Valve's own servers, and payment information, passwords, and Steam Guard codes are confirmed safe. What was likely taken is everything else a shipping partner would hold, including customer names, home addresses, postal codes, phone numbers, Steam account email addresses, and hardware purchase details, including the type and price of the ordered product. CEVA stores delivery-related information for up to 90 days after an order, which is why Valve is notifying all customers it can assume were impacted within that window.

Valve warns Steam Machine and Steam Controller buyers in Europe to expect fake messages after logistics partner got hacked 2

VIEW GALLERY - 3 IMAGES

A bad actor who knows your details and that you recently ordered a Steam Machine or Steam Controller has everything needed to craft a convincing phishing message. Valve's warning is to "Expect fake messages, email, SMS or phone, that mention your hardware order and come from Steam, Valve or a delivery company. They may quote your address back to you to prove they're genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to verify your order. Treat all of them as fake."

Read more: Fake playtest invites are targeting Steam users again in latest phishing scam

Valve warns Steam Machine and Steam Controller buyers in Europe to expect fake messages after logistics partner got hacked 1

Valve has also reminded customers of three things that are always true. Steam Support only handles account issues at help.steampowered.com and never through email, Steam Chat, or Discord. Every real Steam login page is on one of four official domains. And Steam Support will never ask for a password or Steam Guard code.

Frequently Asked Questions

TweakBot answers common questions about this news using TweakTown's own coverage from this page and related content from our archive. All answers are generated from TweakTown content and not outside sources. Tap a question to reveal the answer, or type your own below related to this content.

Question #1

How long does CEVA retain delivery-related information, and why is Valve notifying customers within that retention window?

Question #2

How can customers contact Valve or the designated contact point if they have questions about the breach?

Question #3

What steps has Valve reported taking in response to the CEVA breach (e.g., notifications, isolating systems, pressing CEVA)?

Have a question about this content not listed here? Ask below and TweakBot will answer it.

Valve says it is pressing CEVA for the full scope of what was taken, has isolated the affected systems, and is in the process of notifying data protection authorities across affected countries. Anyone with questions can reach Valve through its support site or through the designated contact point, Artana Digital GmbH in Hamburg.