[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$feTh-EYCRsd-ny46IE23w-DEGd6O9642Cb7gd3ymHM6c":3,"$f9Dfmeb1CjXIcRVmVjLIlYiPqw2kGs5j7viGe8LtsQZs":80},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":77,"created_at":78,"updated_at":79,"published_at":31},"steam-customer-data-exposed-in-ceva-logistics-cyberattack","Steam Customer Data Exposed in CEVA Logistics Cyberattack","Valve confirms CEVA Logistics breach exposed Steam customer data; CoinbaseCartel is the suspected actor behind the July–August 2026 attack.","CEVA Logistics suffered a cyberattack in July–August 2026 that exposed Steam customer data, with CoinbaseCartel as the likely extortion group behind the breach.",[10,11,12,13,14],"Steam","CEVA Logistics","CoinbaseCartel","cyberattack","data breach","# Steam Customer Data Exposed in CEVA Logistics Cyberattack\n\n*Valve confirms CEVA Logistics breach exposed Steam customer data; CoinbaseCartel is the suspected actor behind the July–August 2026 attack.*\n\n**Tags:** `Steam` `CEVA Logistics` `CoinbaseCartel` `cyberattack` `data breach`\n\n> CEVA Logistics suffered a cyberattack in July–August 2026 that exposed Steam customer data, with CoinbaseCartel as the likely extortion group behind the breach.\n\n---\n\n## What happened\n\nCoinbaseCartel, a data-theft extortion group active since September 2025, has claimed a new victim in the form of CEVA Logistics, a global logistics provider. The group posted the listing on its Tor-based leak site, asserting that it exfiltrated customer data from CEVA’s systems and is holding it for ransom. The attack window spans July through August 2026, with the leak site entry timestamped 28 August 2026.\n\nThe stolen data includes Steam customer records pulled from CEVA’s environment. Valve confirmed that CEVA held Steam customer data but did not have access to Steam passwords, Steam Guard codes, or payment information. The dataset covers order details, which is what makes this a phishing risk for customers who recently received high-value electronics. No physical theft has been reported yet, but customers should expect delivery-related scams in the coming days.\n\nCoinbaseCartel’s modus operandi is pure data exfiltration—no encryption, no disruption. The group relies on infostealer logs (RedLine, Lumma, Vidar) for initial access and credential harvesting. By April 2026 it had claimed over 160 victims; the current count sits at 207 across 34 countries, with Technology leading the sector breakdown at 63 victims. The group has been active for roughly 11 months and has been ranked in the top ten most active extortion groups for both September and December 2025.\n\n## Technical details\n\nCoinbaseCartel does not deploy its own malware on victim endpoints. Initial access and credential harvesting rely on infostealer logs—specifically RedLine, Lumma, and Vidar—purchased or shared through the group’s partnerships intake page. The infostealer captures browser credentials, form data, and saved passwords, which the group then uses to pivot into CEVA’s environment and pull Steam customer records.\n\nThe attack chain is a single-extortion model: no file encryption, no system disruption. The group exfiltrates the dataset and lists the victim on its Tor DLS under one of three statuses—Active, Leaking, or Leaked. The leak site runs at `fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion`, last visited 28 August 2026. A single YARA rule (`coinbasecartel.yar`) and one Tox IOC (`58041B45371485934F798C77F2F9705DA735F28AC9EBA2A19B4C9DBAF462802B88E33CEF482A`) are published for detection.\n\nNo CVE is assigned for this incident. The group’s TTPs map to MITRE ATT&CK techniques for File and Directory Discovery, Financial Theft, External Remote Services, User Execution via Malicious File, and Impair Defenses through Disable or Modify Tools. Phishing is handled via Spearphishing and Vishing, which is where the Steam order data becomes a delivery-scam vector for affected customers.\n\n## Who is affected\n\nThe CEVA Logistics breach is the latest in a run of 207 claimed victims across 34 countries, with Technology leading the sector breakdown at 63 targets. The group has been active since September 2025 and has been ranked in the top ten most active extortion groups for both September and December 2025. By April 2026 it had claimed over 160 victims; the current count sits at 207, with the CEVA entry timestamped 28 August 2026.\n\nThe stolen data covers Steam customer records pulled from CEVA’s environment. Valve confirmed CEVA held Steam customer data but did not have access to Steam passwords, Steam Guard codes, or payment information. The dataset includes order details, which is what makes this a phishing risk for customers who recently received high-value electronics. No physical theft has been reported yet, but customers should expect delivery-related scams in the coming days.\n\n## What to do\n\nDefenders should start by hunting the infostealer logs that seeded the compromise. The group publishes a single YARA rule, `coinbasecartel.yar`, which covers the RedLine, Lumma, and Vidar variants it runs on victim endpoints. For endpoint detection, load the rule into your EDR or YARA scanner and scan for the Tox IOC `58041B45371485934F798C77F2F9705DA735F28AC9EBA2A19B4C9DBAF462802B88E33CEF482A` in memory or on disk. The YARA rule and Tox hash are the only published IOCs, so add them to your threat feed and push them to endpoints that were active in the last 30 days.\n\nFor mitigation, rotate all credentials that passed through the infostealer—browser passwords, form data, and saved logins are all in the logs. Force a password reset for any user who logged in via the infostealer, and invalidate Steam Guard codes if the customer used the same browser. The group’s TTPs map to MITRE ATT&CK techniques for File and Directory Discovery, Financial Theft, External Remote Services, User Execution via Malicious File, and Impair Defenses, so check for disabled or modified security tools on the CEVA host. No CVE is assigned, so there’s no patch to apply—this is a data exfiltration, not a code vulnerability.\n\nValve confirmed CEVA held Steam customer data but did not have access to Steam passwords, Steam Guard codes, or payment information. That means the dataset is order data, which is why the phishing risk is real for customers who just got high-value electronics. Expect delivery-scam calls and messages in the next few days. The leak site is live at `fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion`, last visited 28 August 2026. If you’re not CEVA or a direct Steam customer, you’re not affected—this is a single-extortion model, no file encryption, no system disruption.\n\n## Key points\n\n- CEVA Logistics was hit by a cyberattack in July–August 2026 that exposed Steam customer data.\n- Valve confirms CEVA had access to Steam customer data but not Steam passwords, Steam Guard codes, or payment info.\n- CoinbaseCartel is the suspected actor, having previously listed CEVA as a victim in September 2025.\n- The group is a data-theft-only extortion outfit active since September 2025 with 178+ claimed victims.\n- Affected Steam customers should watch for fake delivery calls, messages, and visitors.\n\n## Further reading & sources\n\n- [Steam Customer Data Exposed in CEVA Logistics Cyberattack](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fsteam-customer-data-ceva-logistics-cyberattack) — SOC Radar\n- [Ransomware.live: coinbasecartel](https:\u002F\u002Fransomware.live\u002Fgroup\u002Fcoinbasecartel)\n- [Ransomware.live: coinbasecartel](https:\u002F\u002Fwww.ransomware.live\u002Fgroup\u002Fcoinbasecartel)\n- [CoinbaseCartel](https:\u002F\u002Fwww.halcyon.ai\u002Fthreat-group\u002Fcoinbasecartel)\n- [Dark Web Profile: CoinbaseCartel](https:\u002F\u002Fsocradar.io\u002Fblog\u002Fdark-web-profile-coinbasecartel\u002F)\n- [coinbasecartel - Ransomware Group | Ransomwhere.org](https:\u002F\u002Fransomwhere.org\u002Fgroups\u002Fcoinbasecartel)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsteam-customer-data-exposed-in-ceva-logistics-cyberattack.png?v=170450bf47",{"iocs":18,"actors":25,"malware":33,"targets":42,"timeline":50,"industries":67,"technologies":75},[19,22],{"type":20,"value":21},"domain","fjg4zi4opkxkvdz7mvwp7h6goe4tcby3hhkrz43pht4j3vakhy75znyd.onion",{"type":23,"value":24},"other","58041B45371485934F798C77F2F9705DA735F28AC9EBA2A19B4C9DBAF462802B88E33CEF482A",[26],{"url":27,"name":28,"slug":29,"type":30,"origin":31,"motivation":32},"\u002Fthreat-groups\u002Fcoinbasecartel","Coinbase Cartel","coinbasecartel","ransomware",null,"financial",[34,36,38,40],{"name":35},"coinbasecartel.yar",{"name":37},"Vidar",{"name":39},"RedLine",{"name":41},"Lumma",[43,46],{"name":11,"sector":44,"status":45,"geography":31},"logistics","claimed",{"name":47,"sector":48,"status":49,"geography":31},"Valve","gaming","confirmed",[51,55,59,63],{"date":52,"event":53,"description":54},"2026-07-29","Attack start","Attack on CEVA begins",{"date":56,"event":57,"description":58},"2026-08-01","Attack end","Attack on CEVA ends",{"date":60,"event":61,"description":62},"2026-08-07","Discovery","Valve learns about the breach",{"date":64,"event":65,"description":66},"2026-08-10","Notification","Valve notifies customers",[68,72],{"url":69,"name":70,"slug":71},"\u002Findustries\u002Ftransportation","Transportation","transportation",{"url":73,"name":74,"slug":48},"\u002Findustries\u002Fgaming","Gaming",[76],{"vendor":47,"product":10},"breach","2026-08-28T12:18:01.176354+00:00","2026-10-16T12:29:08.790438+00:00",{"articles":81},[82,94,106,117],{"slug":83,"title":84,"summary":85,"tags":86,"hero_image_url":92,"story_type":77,"created_at":93},"penta-security-south-korean-startup-platform-returns-encryption-key-in-same-api-","Penta Security: South Korean Startup Platform Returns Encryption Key in Same API Response as Encrypted Data","A government-backed South Korean startup support platform leaked personal data for startup founders and business owners because its API returned the encryption key alongside the encrypted payload, a finding from Penta Security's analysis.",[87,88,89,90,14,91],"Penta Security","South Korea","API","encryption key","PIPA","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fpenta-security-south-korean-startup-platform-returns-encryption-key-in-same-api-.png?v=15d19611aa","2026-09-25T07:03:08.188421+00:00",{"slug":95,"title":96,"summary":97,"tags":98,"hero_image_url":104,"story_type":77,"created_at":105},"trezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers","Trezor Confirms Data Breach at ShipMonk Affecting 14,000 Customers","Trezor has confirmed that its third-party shipping partner, ShipMonk, suffered a data breach impacting 14,000 customers after attackers leveraged a SQL injection flaw in the Metabase platform.",[99,100,101,102,103],"Data Breach","ShinyHunters","Trezor","ShipMonk","Metabase","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ftrezor-confirms-data-breach-at-shipmonk-affecting-14-000-customers.png?v=f8ae5b52ce","2026-08-18T17:57:49.084977+00:00",{"slug":107,"title":108,"summary":109,"tags":110,"hero_image_url":115,"story_type":77,"created_at":116},"exposed-aws-access-key-linked-to-data-breach-affecting-1500-uk-charities","Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities","CRM provider Beacon attributes a breach impacting around 1,500 UK charities to a compromised AWS access key that was likely exposed during software development, leading to the exfiltration of supporter personal data.",[111,99,112,113,114],"AWS","Charities","Beacon CRM","Credential Exposure","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fexposed-aws-access-key-linked-to-data-breach-affecting-1500-uk-charities.png?v=ec1f5046ce","2026-08-18T14:16:09.055717+00:00",{"slug":118,"title":119,"summary":120,"tags":121,"hero_image_url":126,"story_type":77,"created_at":127},"france-s-dgfip-confirms-breach-after-hacker-zerobytes-claims-600-000-victims","France's DGFiP Confirms Breach After Hacker ZeroBytes Claims 600,000 Victims","French authorities are investigating a breach of the Directorate General of Public Finances (DGFiP) after hacker ZeroBytes claimed to have stolen data on over 600,000 individuals and businesses.",[122,123,124,99,125],"France","DGFiP","ZeroBytes","Government Security","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrance-s-dgfip-confirms-breach-after-hacker-zerobytes-claims-600-000-victims.png?v=fc9efd493d","2026-08-18T08:44:35.455344+00:00"]