Loading story…
Valve has notified European customers who bought Steam hardware that personal delivery and order data was likely stolen after a cyberattack on shipping partner CEVA Logistics. The company said attackers had access to CEVA servers between July 29 and August 1, 2026, exposing names, addresses, phone numbers, email addresses, and the type and price of ordered products tied to Steam hardware shipments, including older purchases such as Steam Machines and Steam Controllers.
Valve said the breach was limited to fulfillment data held by CEVA and did not expose Steam account credentials, payment card information, or Steam Guard codes. The company warned affected customers to expect phishing emails, text messages, and phone calls impersonating Valve, Steam, or delivery firms, including scams requesting customs or delivery fees or login details. CEVA said it isolated affected systems, notified data protection authorities, and brought in external investigators after the attack also disrupted operations at eight European warehouses.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
Valve said it is notifying data protection authorities in affected countries following the CEVA Logistics breach affecting European Steam hardware customer data. The statement accompanied Valve's customer notifications about the likely exposure of shipping and order information.
Valve began notifying affected Steam hardware customers in Europe about the CEVA Logistics breach and warned them to expect phishing emails, texts, or calls impersonating Steam, Valve, or delivery firms. Valve also said no Steam account credentials, payment information, or Steam Guard codes were exposed.
Valve said it learned on August 7, 2026 that attackers had stolen information tied to European Steam hardware orders handled by CEVA Logistics. The exposed data likely included names, addresses, phone numbers, email addresses, and product type and price.
Bol said the Dutch Data Protection Authority was informed on August 3, 2026 about the possible customer data leak tied to the cyberattack on CEVA Logistics. The notification followed CEVA's August 1 alert to Bol and preceded customer emails sent after further investigation.
IT Pro reported that Levi Strauss was among the organizations believed to be affected by the CEVA Logistics breach, alongside previously disclosed customers such as ING, Bol, De Bijenkorf, Ajax, and Ace & Tate. This expands the known set of CEVA customers impacted by the incident.
Reporting on the CEVA Logistics cyberattack said the compromised data also included personal data belonging to CEVA employees and contract workers, in addition to customer contact and order details. This expanded the known impact beyond previously disclosed downstream customer shipping data.
Multiple organizations, including Bol, De Bijenkorf, Ajax, ING, and Ace & Tate, reported that customer shipping information held by CEVA Logistics was affected by the incident. Some also disclosed operational fallout such as order delays and cancellations tied to the disruption at CEVA's European warehouses.
Ten organizations filed data breach notifications with the Dutch Data Protection Authority in connection with the CEVA Logistics incident. This expands the known regulatory response beyond previously disclosed individual notifications such as Bol's report.
The Dutch Data Protection Authority and other law enforcement agencies were reported to be investigating the CEVA Logistics cyber incident affecting eight European warehouses. The investigation was disclosed alongside retailer notices describing operational disruption and possible exposure of customer shipping data.
CEVA Logistics informed multiple European retailers that a cyberattack had disrupted operations at eight of its warehouses in Europe. This disclosure was reported as occurring on August 1, 2026.
Valve said attackers had access to CEVA Logistics servers during a cyberattack affecting its European hardware distribution operations. The intrusion window was stated as July 29, 2026 through August 1, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
25 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecyberveille.ch
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcenos.nl
Open sourcefreightwaves.com
Open sourcenos.nl
Open sourcedebijenkorf.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dutch retailer **Bol** warned customers that some personal information may have been viewed or copied after unauthorized parties accessed systems at **CEVA Logistics**, a logistics partner that processes and delivers orders from one of Bol’s distribution centers. Bol said its own environment was not compromised, but customer data linked to the partner’s operations was affected, and reports indicated the stolen information was being offered for sale on the dark web. The disclosure followed a similar warning from **De Bijenkorf**, which also linked its incident to a logistics partner and said the breach likely affected customer data. Reporting suggested the two cases are related, pointing to a broader third-party supply-chain compromise centered on CEVA Logistics, with De Bijenkorf also experiencing order-processing delays as the incident disrupted operations.
Aug 7, 2026
Trezor disclosed that unauthorized access at third-party logistics provider **ShipMonk** exposed customer order data for **13,689** hardware wallet buyers, affecting recent deliveries across the **U.S., U.K., Sweden, Colombia, Brazil, Italy, and Portugal**. The exposed information included full names, email addresses, phone numbers, and shipping addresses for **11,742** customers, while **1,947** others had more limited data exposed, such as name, city, and email address. Trezor said ShipMonk notified it of the incident after attackers accessed systems containing order records tied to shipments delivered between **May 10 and Aug. 8, 2026**. Trezor said its own infrastructure, wallets, devices, and firmware were **not compromised**, but warned affected customers to expect phishing, impersonation, and possible physical-security risks because the leaked data links identities to hardware wallet purchases. The company said its **90-day data retention policy** limited the scope because older records had already been deleted or anonymized, and it has notified impacted users by email while working with ShipMonk as the provider secures and hardens affected systems. Trezor also said it plans to roll out an **Anonymous Delivery** option, first in the EU and later in the U.S., to reduce future customer exposure.
Aug 16, 2026
Spanish technology retailer **PcComponentes** denied claims that attackers stole a customer database affecting roughly **16 million** users after a threat actor, **“daghetiaw,”** alleged theft of **16.3 million** records, leaked a sample (reported as **~500,000** records), and offered the remainder for sale. The allegedly exposed data was described as including customer PII and commerce/support artifacts such as names, physical addresses, phone numbers, IP addresses, order details, wish-lists, and customer support messages (including exchanges via *Zendesk*). PcComponentes stated its investigation found **no evidence of unauthorized access** to its databases or internal systems and disputed the claimed scale, noting the number of active accounts is significantly lower; it also said it does not store customer passwords or financial details. PcComponentes confirmed it experienced a **credential stuffing** attack, in which attackers attempt logins using reused email/password pairs sourced from other breaches. Threat intelligence firm **Hudson Rock** assessed the credentials likely originated from endpoints infected with **info-stealing malware**, aligning with the credential-reuse pattern. In response, PcComponentes implemented additional controls including **CAPTCHA** on login pages, **mandatory 2FA** for all accounts, and **session invalidation** requiring users to re-authenticate and enable 2FA.
Jun 29, 2026