Valve warns of a data breach that affects users who have pre-ordered Steam hardware in Europe

Specifically, this data breach has been caused by a cyber attack suffered by CEVA Logistics, Valve’s partner to manage hardware shipments to customers in Europe. This company receives specific information from Steam users in order to ship physical products to customers in this region.

In this sense, the video game company has notified a security incident through an email shared with users, to which The Verge has had access, and which indicates that The cyberattack took place between July 29 and August 1, at which time reservations for Steam devices could be made.

CEVA is currently continuing to investigate the incident, however, it has detailed that “it is likely” that “some information” about Steam customers who have recently placed a pre-order order for their ‘hardware’ has been compromised, “given that CEVA retains information for a maximum of 90 days after placing the order.” This includes those who have pre-ordered the new Steam Machine console and Steam Machina controller.

Thus, in the ’email’ shared with users it has been specified that the purchase information may have been compromised, with data such as name, address, zip code and city, telephone number and email address (the same one used in the Steam account). The type and price of the requested product may also have been filtered.

Nevertheless, The company has assured that the rest of the information related to the Steam account “has not been affected”. This is because CEVA does not have access to payment information, as well as Steam login passwords, Steam Guard codes, or “any other data.”

In this regard, Valve has alerted users that they may receive possible false messages by email, SMS or phone, with information that appears to come from Steam, Valve or a messaging company.

“They may ask you to confirm a delivery, pay a small customs or forwarding fee, or log in somewhere to verify your order. Consider them all fake,” the company said.

Likewise, it has also clarified that it is not necessary for users to change their password or make any changes to the settings in their account. However, CEVA has isolated the affected systems and continues to investigate with external security companies.