Valve’s Steam hardware data warning means phishing just got more convincing

A real name, home address, phone number, and the exact Steam hardware you bought are more than enough for a scammer to build a delivery message that looks alarmingly legitimate. Valve is warning European Steam hardware customers that a cyberattack on shipping partner CEVA Logistics may have exposed that information — and that fake messages should be expected.

The good news is meaningful: Valve says CEVA did not have access to payment information, Steam passwords, Steam Guard codes, or other Steam account data. This is not a breach of Steam itself. The bad news is that delivery data is precisely what makes phishing work, because it gives criminals the details needed to make a fake “missed delivery” text feel tailored rather than random.

Recent European hardware orders are the likely target

The CEVA attack took place between July 29 and August 1, with Valve learning of the potential exposure on August 7. Customers who bought Steam hardware in Europe within roughly the past 90 days are the group most likely to be affected, reflecting how long CEVA retains delivery records.

Potentially exposed information includes names, addresses, phone numbers, email addresses, the product ordered, and its price. That could cover Steam Deck orders and other Steam hardware fulfilled through CEVA. Valve is notifying customers directly, but anyone in that recent-order window should treat delivery-themed contact with extra suspicion.

Your address in a text proves nothing now

This is the part the usual “don’t click suspicious links” advice tends to undersell. A fraudulent message may know where you live, what you ordered, and how to reach you. Those details used to be useful warning signs that a delivery notification was genuine. In this case, they may be the bait.

• “We could not deliver your Steam hardware order. Confirm your address.”
• “A small customs or redelivery fee is required.”
• “Verify your order by signing in to Steam.”
• “Your package is being held until you respond.”

Every one of those messages should be treated as fake until independently verified. Do not use its link, phone number, reply address, or QR code. Open the Steam client or your normal Steam bookmark yourself, and use carrier contact details you already know if there is a genuine delivery concern.

Do the defensive checks, but do not panic-reset everything

Valve says passwords and Steam Guard codes were not exposed, so there is no evidence that affected accounts require an emergency password reset. Resetting a password can be sensible personal hygiene, but it does not solve the immediate threat: someone tricking you into handing over fresh credentials on a fake page.

Instead, check your Steam Guard status, review recent account email changes, confirm that authorized devices are familiar, and look over your payment methods and login activity. Keep Steam Guard enabled. If any message asks you to log in because of a shipping problem, close it. A real delivery dispute does not need your Steam credentials.

The next few weeks are the danger window

CEVA’s breach reportedly reaches beyond Valve, which means delivery impersonation attempts may not stick neatly to Steam branding. A text about a warehouse delay, address correction, customs charge, or missed parcel deserves the same treatment: verify it from a clean starting point, never from the message that arrived uninvited.

Valve has already spelled out the practical risk. The scam that matters will not look like a badly translated email from a stranger. It will look like a routine package problem, know enough about you to feel credible, and ask for one small action. That is the action to refuse.