Buyers of Valve's Steam Machine and Steam Controller in Europe need to watch their inboxes and phone lines for fake delivery messages. These scams are not random spam but targeted attempts using real data stolen from Valve's logistics partner. The risk is immediate for anyone who ordered hardware recently, as criminals use stolen addresses to make their fraud look legitimate.
Targeted scams use stolen delivery data to trick European customers
Valve issued this warning after its logistics provider, CEVA Logistics, suffered a cyberattack between July 29 and August 1. The breach exposed delivery data that CEVA stores for up to 90 days. Valve is now contacting customers whose information falls within that window to alert them to the potential compromise.
Scammers are crafting messages that appear to come from Steam, Valve, or courier services. They may quote your specific delivery address to prove they know your details. They might ask you to pay a small customs fee, confirm a redelivery, or sign in to verify your order. Valve explicitly states that all such messages should be treated as fake.
Valve confirmed that its own servers, payment information, passwords, and Steam Guard codes remain secure. The breach was limited to the logistics partner's delivery records. Users should direct any questions to help.steampowered.com and avoid sharing passwords via email or chat.
We touched on Valve Engineer Warns Steam Machine RAM in our earlier Valve coverage. This security notice highlights the collateral damage of supply chain attacks on hardware buyers. The company is prioritizing customer safety over product announcements in this instance.
Customers should verify any delivery contact through official channels rather than clicking links in unsolicited messages. Valve's guidance is clear: treat any request for payment or login details from these sources as fraudulent. This advisory protects buyers from financial loss and account theft.
Source: TweakTown
