Valve confirmed this week that a cyberattack on CEVA Logistics, its European shipping partner, exposed the names, addresses, phone numbers, and order details of customers who bought Steam Deck, Steam Machine, or Steam Controller hardware.
The attack took place between July 29 and August 1, and Valve began notifying affected customers on August 10.
Passwords, Steam Guard codes, and payment information were not part of the breach. That’s the important distinction here, this isn’t an account compromise. But the exposed data, real names, real addresses, real order details, is exactly what makes phishing attempts convincing.
A scam message that correctly references your actual order number or shipping address is far more likely to be trusted than a generic one.
If you’ve purchased Steam hardware recently, the practical advice is simple: treat any unexpected email, text, or phone call referencing your order as suspicious by default, even if the details check out. Valve will not ask for your password, payment information, or Steam Guard codes through any of these channels.
If you’re unsure whether a message is legitimate, go directly to Steam’s support site rather than clicking a link or calling a number provided in the message itself.
If you want a general layer of protection against phishing attempts like this, I use and am an affiliate for NordVPN, its built-in threat protection blocks known phishing and scam sites in real time, before you’re able to enter a password or lose money. It’s currently offering 75 percent off two-year plans.