Hackers Are Going Phishing For European Steam Machine And Controller Owners

While Valve's Steam digital storefront is divisive at the best of times, you cannot fault the company's ability to develop quality games and products. Just look at the newest Steam VR headset and how it fixes one of VR's biggest problems. However, a company's cybersecurity is only as strong as its weakest link, especially when it works with an overseas logistics partner.

Earlier today, news hit the internet that Valve had suffered a massive breach — or to be more specific, that its partner, CEVA Logistics, was hacked. This company handles all hardware fulfillment for Valve across Europe. While Valve reassured potential victims that none of their login credentials or payment information was exposed, the hack did potentially reveal the "names, addresses, countries, phone numbers, Steam account email addresses, and Steam hardware purchase details" of an unknown number of people.

According to Valve, the actual attack struck CEVA between July 29 and August 1, and Valve only learned of the intrusion on August 7. As of writing, CEVA is still investigating the full scope of the damage. Since CEVA "receives specific delivery-related information from Steam ... to ship physical hardware to customers," anyone who lives in Europe and purchased a Steam Machine, Steam Controller, or even a Steam Deck within the past 90 days is now a victim of the attack.

Since CEVA Logistics only ensures the shipping of Valve hardware across Europe, the company only has access to what Valve gives it (i.e., customer names, addresses, and contact information). While that's not enough to steal someone's bank account, it's enough for hackers to get started.

In an email Valve sent out, the company warned potential victims that hackers might try to send fake messages regarding their orders, i.e., phishing scams. The hackers would likely "quote your address back to you to prove they're genuine," and if successful, they could ask for any number of seemingly reasonable favors. These could include requesting payment for customs fees or asking you to sign in and "verify" an order. Just treat these messages, be they via email or phone call/message, the same way you treat scam emails you identify: Just ignore them.

Valve would like to remind all potential victims that the company will never contact anyone by email, Discord, or any other messaging system. And if you are ever prompted to log into your account, only do so from sites such as www.steampowered.com, and even then, only if you type the URL yourself. In the meantime, Valve is "pressing CEVA for the full scope of what was taken and how" and working with "data protection authorities" across Europe. If you are reading this and are one of the many people affected, here's hoping you get a free one-year subscription to a credit monitoring and anti-identity theft subscription out of the debacle.