{"id":"ceva-logistics-customer-data-breach-jul-2026","category":"breach","status":"closed","title":"CEVA Logistics breach disrupts European deliveries and prompts Steam hardware customer warnings","tldr":"An attack disrupted eight CEVA warehouses and exposed retailers’ customer data. Valve warned European Steam hardware buyers, though a later customer-shared email cleared its recipient. Check your retailer’s notice and verify delivery requests directly.","summary":"An attack beginning on 29 July disrupted eight CEVA Logistics warehouses in Europe, delaying retailers’ deliveries and returns. Valve warned European Steam hardware customers on 10 August that their names, delivery addresses, phone numbers, email addresses and ordered products and prices were likely taken. CEVA retained that shipping information for up to 90 days; Valve said payment details, passwords and Steam Guard codes were not involved. Later findings changed the picture for at least one recipient: a Valve email posted by a customer on 16 September said their order system was unaffected and there was no indication their data had been accessible. That is not confirmation that all Steam customers were unaffected. Separately, Ace & Tate resumed CEVA services on 27 August, confirmed customer data theft in September and issued further notifications. Its notice reports no evidence of publication online. As at 3 November, the reviewed sources disclose no affected-customer total or entry method, and do not establish whether stolen information has been used in scams.","action":"Check your retailer’s incident notice and any follow-up that changes whether your order was affected. Verify unexpected delivery or fee requests through the retailer’s website, opened directly; do not provide passwords or Steam Guard codes to callers or message senders. Valve says this incident does not require changing your Steam password or account settings.","product":"CEVA Logistics European warehousing and delivery services, including Steam hardware fulfilment","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["ceva-logistics","valve","steam","data-breach","europe","retail"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security incident at our logistics partner","url":"https://www.aceandtate.com/ch-en/security-incident","by":"Ace & Tate","date":"2026-09-14"},{"kind":"post","title":"Valve’s initial customer notification, reproduced by a recipient","url":"https://www.reddit.com/r/Steam/comments/1vkgcaz/psa_europeanlogistics_partner_for_steam_hit_in/","by":"Reddit user Rooxe_, reproducing a Valve email","date":"2026-08-10"},{"kind":"news","title":"Valve notifies Steam hardware customers of a data breach","url":"https://www.bleepingcomputer.com/news/security/valve-notifies-steam-hardware-customers-of-a-data-breach/","by":"BleepingComputer","date":"2026-08-10"},{"kind":"news","title":"A data breach at shipping giant Ceva Logistics is rippling across banks, retailers, Steam gamers, and beyond","url":"https://techcrunch.com/2026/08/10/a-data-breach-at-shipping-giant-ceva-logistics-is-rippling-across-banks-retailers-steam-gamers-and-beyond/","by":"TechCrunch","date":"2026-08-10"},{"kind":"news","title":"The CEVA Logistics data breach is having major knock-on effects across Europe - here's what we know","url":"https://www.techradar.com/pro/security/the-ceva-logistics-data-breach-is-having-major-knock-on-effects-across-europe-heres-what-we-know","by":"TechRadar","date":"2026-08-11"},{"kind":"post","title":"Valve’s follow-up customer notification, reproduced by a recipient","url":"https://www.reddit.com/r/Steam/comments/1whpev5/an_update_about_the_security_incident_at_valves/","by":"Reddit user xenius_ykk, reproducing a Valve email","date":"2026-09-16"}],"started":"2026-07-29","closed":"2026-09-16","created":"2026-11-03T21:05:54.593Z","updated":"2026-11-03T21:05:54.593Z","cve_notes":[],"timeline":[{"at":"2026-09-16","added":"2026-11-03T20:51:54.186Z","kind":"vendor-revised","text":"A customer posted a follow-up Valve email saying the system handling their order was unaffected, with no indication their data had been accessible. This customer-shared message does not establish an all-clear for every Steam hardware customer.","url":"https://www.reddit.com/r/Steam/comments/1whpev5/an_update_about_the_security_incident_at_valves/","by":"Reddit user xenius_ykk, reproducing a Valve email","patch":null},{"at":"2026-09-14","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Ace & Tate began sending updated notifications, including to additional customers identified by the investigation.","url":"https://www.aceandtate.com/ch-en/security-incident","by":"Ace & Tate","patch":null},{"at":"2026-09-10","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"CEVA confirmed to Ace & Tate that its customers’ personal information had been accessed and copied.","url":"https://www.aceandtate.com/ch-en/security-incident","by":"Ace & Tate","patch":null},{"at":"2026-08-27","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"Ace & Tate resumed CEVA services, including orders, shipping and returns, following independent security checks reported by CEVA.","url":"https://www.aceandtate.com/ch-en/security-incident","by":"Ace & Tate","patch":null},{"at":"2026-08-10","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Valve notified European Steam hardware customers that names, addresses, phone numbers, email addresses and product types and prices were likely taken. It said CEVA held no payment details, passwords or Steam Guard codes.","url":"https://www.bleepingcomputer.com/news/security/valve-notifies-steam-hardware-customers-of-a-data-breach/","by":"BleepingComputer","patch":null},{"at":"2026-08-06","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"Ace & Tate emailed potentially affected customers after notifying Dutch and UK privacy regulators on 5 August.","url":"https://www.aceandtate.com/ch-en/security-incident","by":"Ace & Tate","patch":null},{"at":"2026-08-01","added":"2026-11-03T20:51:54.186Z","kind":"disclosed","text":"CEVA said it notified affected clients of an intrusion into its European contract logistics operations; disruption was limited to eight warehouses.","url":"https://techcrunch.com/2026/08/10/a-data-breach-at-shipping-giant-ceva-logistics-is-rippling-across-banks-retailers-steam-gamers-and-beyond/","by":"TechCrunch","patch":null},{"at":"2026-07-29","added":"2026-11-03T20:51:54.186Z","kind":"other","text":"The attack began. Valve later identified 29 July to 1 August as the period attackers had access to CEVA systems.","url":"https://www.bleepingcomputer.com/news/security/valve-notifies-steam-hardware-customers-of-a-data-breach/","by":"BleepingComputer","patch":"na"}],"url":"https://hard.fyi/live/ceva-logistics-customer-data-breach-jul-2026/","json":"https://hard.fyi/api/live?id=ceva-logistics-customer-data-breach-jul-2026"}