CEVA Logistics breach disrupts European deliveries and prompts Steam hardware customer warnings
An attack disrupted eight CEVA warehouses and exposed retailers’ customer data. Valve warned European Steam hardware buyers, though a later customer-shared email cleared its recipient. Check your retailer’s notice and verify delivery requests directly.
Check your retailer’s incident notice and any follow-up that changes whether your order was affected. Verify unexpected delivery or fee requests through the retailer’s website, opened directly; do not provide passwords or Steam Guard codes to callers or message senders. Valve says this incident does not require changing your Steam password or account settings.
What’s happening
An attack beginning on 29 July disrupted eight CEVA Logistics warehouses in Europe, delaying retailers’ deliveries and returns. Valve warned European Steam hardware customers on 10 August that their names, delivery addresses, phone numbers, email addresses and ordered products and prices were likely taken. CEVA retained that shipping information for up to 90 days; Valve said payment details, passwords and Steam Guard codes were not involved. Later findings changed the picture for at least one recipient: a Valve email posted by a customer on 16 September said their order system was unaffected and there was no indication their data had been accessible. That is not confirmation that all Steam customers were unaffected. Separately, Ace & Tate resumed CEVA services on 27 August, confirmed customer data theft in September and issued further notifications. Its notice reports no evidence of publication online. As at 3 November, the reviewed sources disclose no affected-customer total or entry method, and do not establish whether stolen information has been used in scams.
- What
- Breach
- Affects
- CEVA Logistics European warehousing and delivery services, including Steam hardware fulfilment
- Fixed in
- Nothing to patch
- Since
- 29 July 2026
- Closed
- 16 Sept 2026
Timeline
- Vendor revised
A customer posted a follow-up Valve email saying the system handling their order was unaffected, with no indication their data had been accessible. This customer-shared message does not establish an all-clear for every Steam hardware customer.
- Update
Ace & Tate began sending updated notifications, including to additional customers identified by the investigation.
- Update
CEVA confirmed to Ace & Tate that its customers’ personal information had been accessed and copied.
- Update
Ace & Tate resumed CEVA services, including orders, shipping and returns, following independent security checks reported by CEVA.
- Made public
Valve notified European Steam hardware customers that names, addresses, phone numbers, email addresses and product types and prices were likely taken. It said CEVA held no payment details, passwords or Steam Guard codes.
- Made public
Ace & Tate emailed potentially affected customers after notifying Dutch and UK privacy regulators on 5 August.
- Made public
CEVA said it notified affected clients of an intrusion into its European contract logistics operations; disruption was limited to eight warehouses.
- UpdateNothing to patch
The attack began. Valve later identified 29 July to 1 August as the period attackers had access to CEVA systems.
Sources
- Security incident at our logistics partnerAce & Tate · 14 Sept 2026
- Valve’s initial customer notification, reproduced by a recipientReddit user Rooxe_, reproducing a Valve email · 10 Aug 2026
- Valve notifies Steam hardware customers of a data breachBleepingComputer · 10 Aug 2026
- A data breach at shipping giant Ceva Logistics is rippling across banks, retailers, Steam gamers, and beyondTechCrunch · 10 Aug 2026
- The CEVA Logistics data breach is having major knock-on effects across Europe - here's what we knowTechRadar · 11 Aug 2026
- Valve’s follow-up customer notification, reproduced by a recipientReddit user xenius_ykk, reproducing a Valve email · 16 Sept 2026