Valve shares delivery-related information with CEVA so that it can ship Steam hardware in Europe, and it appears that this personal data is what was stolen. This personally identifiable information (PII) may include your name, address, country, phone number, email address, and the details of the products you ordered. CEVA stores customer data for up to 90 days after an order is assigned to them, which means that the data for lots of customers may have been leaked. Fortunately, payment information, Steam account details, authentication codes, and more are not stored at CEVA.

The leak was not from Valve but from the shipping company used to distribute their hardware in Europe. Your Steam account details are not leaked, but any information related to shipping probably is.

Following this breach and the subsequent exfiltration of data, Valve has asked customers to be wary of contact attempts from fraudulent entities who have taken hold of your leaked information and may use it to prove that they are genuine. Customers do not need to change their passwords, but they definitely should not share their account details with any person identifying them as a courier service for your hardware.