Steam ハードウェアの欧州配送業者がデータ侵害、顧客の氏名・住所など流出Steam hardware shipper breach leaks customer data, including names and addresses

Valve has begun notifying customers that a data breach at one of its logistics providers may have exposed personal information belonging to people who ordered Steam hardware in Europe. According to an email the company sent to affected users, the incident occurred at CEVA Logistics, Valve's European shipping partner, and appears to have involved customer names and addresses. For a company that usually keeps a low profile around the operational side of its hardware business, the disclosure is a reminder that customer data can be exposed well beyond the storefront where a purchase is made.

Based on Valve's account, the breach did not originate inside Valve's own systems but at CEVA Logistics, the third party responsible for shipping Steam hardware to European buyers. Valve says the compromised information may have included the names and postal addresses that customers provide when placing an order for physical delivery. Because shipping partners typically handle the data needed to fulfill and deliver a package, the exposure is likely centered on delivery details rather than the full account or payment information customers use on Steam itself. Valve has not, in the excerpt available, described the total number of affected customers or the exact timeframe of the incident.

CEVA Logistics is a large global freight and contract logistics company, and it operates as one of many outside vendors that platform holders rely on to move physical goods. That relationship is central to understanding the incident: modern hardware sales depend on a chain of partners for warehousing, shipping, and last-mile delivery, and each link in that chain holds some slice of customer data. A breach at any one of them can affect the original retailer's customers even when the retailer's own infrastructure is untouched. This kind of supply-chain or third-party exposure has become one of the more common ways personal data leaks, precisely because attackers can target a vendor that serves many clients at once.

The affected purchases involve Steam hardware, the category Valve uses for products such as the Steam Deck handheld gaming PC and related accessories. Valve sells and ships these devices directly to consumers in supported regions, and in Europe that fulfillment has run through partners including CEVA. Direct-to-consumer hardware sales require Valve to collect and pass along shipping information, which is standard for any company mailing physical products but also widens the pool of parties that store a customer's name and address. The notification appears limited to European customers who ordered hardware, consistent with CEVA's role as the regional shipping partner rather than a worldwide one.

Names and mailing addresses are lower-risk than financial data on their own, but they are not harmless. Such details can be used to make phishing messages more convincing, since a scammer who already knows a target's name, address, and the fact that they bought a Steam device can craft a more believable pretext. Security researchers generally advise recipients of breach notifications to be wary of unsolicited emails or messages referencing their purchase, to avoid clicking links in unexpected communications, and to verify any request that claims to come from Valve or a delivery service by going directly to the official site. Enabling protections such as Steam Guard two-factor authentication remains good practice even when account credentials are not believed to be part of a given incident.

The episode fits a broader industry pattern in which gaming and technology companies increasingly have to account for the security posture of their vendors, not just their own networks. Data-protection regimes in Europe, notably the General Data Protection Regulation, impose notification obligations when personal data is compromised, which helps explain why affected customers are being told directly. Valve's outreach by email is the typical first step in that process, allowing customers to take precautions while the companies involved investigate.

For now, the key facts remain narrow: Valve says a breach at CEVA Logistics may have exposed the names and addresses of European customers who ordered Steam hardware. Further details, including the scope of the incident and any additional data categories involved, would need to come from Valve or CEVA as their review continues. Customers who receive the notice should treat it as a prompt to stay alert to targeted scams rather than as evidence that their Steam accounts themselves have been compromised.