Executive Summary
Global logistics and supply chain provider CEVA Logistics has suffered a cyberattack impacting fulfillment systems for gaming giant Valve. The intrusion resulted in the exfiltration of shipment databases containing sensitive personal information of customers who purchased Steam hardware—including Steam Deck handhelds, Valve Index VR headsets, and official accessories. Exposed data includes customer full names, physical delivery addresses, contact telephone numbers, email addresses, and package tracking identifiers.
Deep-Dive Technical Analysis
The security breach occurred within a third-party logistics (3PL) database segment managed by CEVA Logistics dedicated to handling e-commerce order fulfillment for Valve in North America and Europe. Threat actors executed an intrusion via compromised partner portal credentials, bypassing multi-factor authentication controls on a legacy supply-chain management API.
Once inside the logistics environment, attackers queried fulfillment databases containing historical and active shipment manifest records.
Data Category
Status
Details
Personal Identifiers
Exposed
Full names, email addresses, phone numbers
Logistics Data
Exposed
Shipping/billing addresses, timestamps, tracking links
Hardware Data
Exposed
Serial numbers of purchased units
Payment Info
Excluded
Financial data stored in Valve's segregated infrastructure
Account Security
Excluded
Steam account login credentials and passwords
Threat actors subsequently listed samples of the stolen logistics data on dark web forums to extort CEVA Logistics.
Industry Impact and Recommendations/Mitigations
This incident underscores the growing trend of threat actors targeting third-party logistics and fulfillment partners to harvest high-value consumer data without needing to breach primary corporate networks.
Protective Guidance for Affected Users and Organizations
1. Phishing Awareness: Customers who recently ordered Steam hardware should remain vigilant against targeted phishing attempts, SMS scams (smishing), or fraudulent delivery notifications referencing exact tracking numbers or home addresses.
2. Third-Party Risk Management (TPRM): Enterprise organizations must mandate strict API security standards, session timeouts, and continuous security telemetry monitoring for all third-party logistics and vendor integration points.
3. Zero-Trust Access Control: Implement strict network segmentation separating vendor fulfillment portals from internal enterprise databases.
Report Prepared By: Person
Date of Analysis: Date