CEVA Logistics hack exposes names, addresses, and phone numbers of Steam customers

Valve is warning users that their personal information may have been compromised because of a data breach at CEVA Logistics last week.

In an email addressed to victims, which has been seen by Cybernews, the American video game developer and publisher says that CEVA Logistics is responsible for shipping Steam hardware to customers in Europe.

On August 7th, Valve was informed about a cyberattack on the logistics partner. According to the company, personal details about Valve’s customers may have been stolen or copied, including names, postal addresses, email addresses, phone numbers, and order history.

The gaming company emphasizes that no payment information or other financial data was compromised. The same goes for usernames, passwords, Steam Guard codes, or other information. Therefore, there’s no need to change Steam passwords.

However, affected users are advised to remain vigilant for any suspicious activities from scammers.

“Expect fake messages – email, SMS, or phone - that mention your hardware order and appear to come from Steam, Valve, or a delivery company. They may quote your address back to you to prove they’re genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to “verify” your order. Treat all of them as fake,” Valve says to European customers.

According to the email, CEVA Logistics has isolated all the affected systems, taken them offline, and called in security experts from outside.

Valve promises to keep pressing CEVA Logistics for the full scope of what happened, how this occurred, and what data was stolen. In addition, Valve is in the process of notifying data protection authorities in the countries affected.

Valve is the latest victim in a series of affected companies due to a security incident at CEVA Logistics.

Last week, Dutch department store De Bijenkorf and online retailer bol disclosed they had become victims of a potential data breach at CEVA. A few days later, Dutch soccer club Ajax disclosed that personal information of an undisclosed number of fans was potentially stolen because of the events at CEVA.

To top it all off, financial institution ING and optician chain Ace & Tate reported that they were also targeted in the attack on CEVA Logistics.