29 July 2026
CEVA Logistics
Company Logistics / supply chain
A cyber intrusion hit part of CEVA Logistics’ European contract-logistics operation beginning around 29 July 2026. CEVA told affected customers that the incident was identified on 1 August and later confirmed to press that the operational impact was limited to eight European warehouses.
The breach became visible through CEVA’s customers. Downstream retailers and Valve, which uses CEVA to ship Steam hardware in Europe, warned that shipping information held by CEVA had been accessed or copied. No public person count has been established.
Dated facts in the public record
Start of the intrusion window later communicated in Valve-related notices and reporting.
CEVA identifies the intrusion, activates security measures and informs affected customers. Operational impact is later described as limited to eight European warehouses.
Valve says it learns that information relating to its European hardware customers was likely compromised. CEVA retained Valve delivery information for up to 90 days after an order.
TechCrunch and other outlets detail the multi-client impact. Valve begins broad customer notification.
Additional reporting identifies more affected retailers and notes that the Dutch data-protection authority has received multiple breach notifications connected with the CEVA incident.
How it happened
CEVA has not published an initial access method, vulnerability, ransomware family or attacker. Physical operational disruption at warehouses led some commentators to speculate about ransomware or destructive malware; that is not a confirmed technical finding. The confirmed response facts are that CEVA isolated affected systems, activated security protocols and brought in external investigators.
What was exposed
For Valve customers, the likely exposed fields were name, street address, phone number, email address, and hardware product type or order details. Other CEVA clients reported overlapping sets of delivery and customer-contact data. The exact total volume across all clients is unknown. Adding each company’s notification count would also risk double counting.
What was not in scope
Valve said CEVA does not hold Steam payment information, passwords, Steam Guard codes or other Steam account credentials. CEVA told reporters that air, ocean, ground and rail operations continued and that the identified operational effect was limited to eight warehouses.
What it meant in practice
The breach creates two layers of risk. Operationally, warehouse disruption can delay orders, returns and refunds. From a privacy perspective, stolen delivery context enables persuasive package scams: a criminal who knows a victim’s address and exact recent hardware purchase can plausibly demand a small customs payment, redelivery fee or account verification.
What was done next
CEVA activated security protocols, isolated affected systems and engaged external investigators. Downstream clients began notifying their customers and relevant data-protection authorities. Valve explicitly warned customers to expect fake messages and said it was pressing CEVA for a fuller account of what had been taken and how.
What later reporting changed
The investigation remained ongoing at the 16 August research cutoff. Technical method, total number of affected people and final number of client organisations should be treated as provisional.
In their words
expect fake messages
Valve customer notice, reported 10 August 2026
Treat all of them as fake.
Valve customer notice, reported 10 August 2026
What does this mean?
- Credentials
- A username and password pair, or the equivalent key an application uses to log in.