Valve began emailing customers across Europe on Monday to tell them that delivery details from their Steam hardware orders were probably stolen. The data was not taken from Valve. It came from CEVA Logistics, which handles delivery of Steam hardware in Europe and was hit by a cyberattack at the end of July.
According to the notice, the attack on CEVA ran from July 29 to August 1. Valve says it learned on August 7 that information about Steam customers was likely part of what the intruders reached, and it started sending warnings three days later. CEVA is still investigating.
The records involved are the ones a courier needs to deliver a parcel: names, street addresses, postal codes, cities and countries, phone numbers, and the email address tied to the customer's Steam account. The type of product ordered and the price paid were exposed as well.
Valve stresses that nothing else about a customer's Steam account or purchase history was involved. CEVA never receives payment information, passwords or Steam Guard codes, so none of those could have been taken from its systems. Customers are told they do not need to change their password or touch their account settings.
Why so many people are getting the email
CEVA holds on to delivery data for as long as 90 days once an order has been placed. Valve cannot tell exactly which records were copied, so it is writing to every customer whose order falls inside that window and treating all of them as affected. The company has not said how many people that is.
The real risk now is targeted phishing. Someone holding a name, a home address, a phone number and the knowledge that a specific piece of hardware was ordered at a specific price can write a very believable message. Valve expects exactly that, by email, text message or phone call, from people posing as Steam, Valve or a delivery firm.
Its notice lists the tricks to watch for:
- Quoting the customer's own address back to them as proof that the sender is genuine.
- Asking them to confirm a delivery.
- Asking for a small customs or redelivery fee.
- Sending them to a page where they should sign in to verify an order.
Valve's advice is to treat every such message as fake.
What is known about the attack on CEVA
CEVA Logistics belongs to the shipping group CMA CGM and runs about 1,000 warehouses. On August 1 it told a number of European retailers that a cyberattack had disrupted operations at eight of its warehouses in Europe, which suggests Steam buyers are not the only consumers whose delivery details passed through the affected systems.
Valve's notice says its partner has cut the affected machines off from the rest of the network, shut them down and called in investigators from outside the company. Valve adds that it is pushing for a full account of what was copied and how, and that it is reporting the incident to the data protection authority in every country where customers were hit.
How the intruders got into CEVA's systems has not been explained so far.
