All Articles

TL;DR for CISOs: Someone else's breach was your problem today. Valve began notifying Steam hardware buyers in Europe that their shipping details were stolen in a cyberattack on its logistics partner, CEVA Logistics, and warned them to expect targeted phishing. LexisNexis pulled three services offline after unusual activity on servers run by a third-party vendor, choosing an outage over an open door. And researchers detailed a supply-chain compromise that poisoned a vendor data feed feeding seven BdThemes WordPress plugins, quietly minting rogue administrators on affected sites. The connective thread is dependence: the data you hand to a vendor and the code you let a vendor run inside your environment are both attack surface you do not fully control.

Valve tells Steam hardware buyers their data was stolen in a breach at shipping partner CEVA Logistics

What happened

The data that fuels a scam does not have to come from your own systems. Valve holds payment details and Steam credentials, and none of that was in play here. What leaked was the mundane shipping information a logistics partner needs to put a box on a doorstep: a name, an address, a phone number, and what was ordered. In the hands of a fraudster, that is more than enough to sound convincing. The attacker who knows your address and your recent purchase can pose as the courier or the retailer and ask for a small fee or a login, and the request lands because the details are real.

This is a clean example of concentration risk in the supply chain. A single logistics provider sits behind many brands, so one intrusion produces notification duty and fraud exposure across all of them at once. Valve's response was orderly: it isolated the messaging to the affected customers, told them plainly what was taken and what was not, and pre-empted the phishing by describing the exact scripts to expect. The lesson is not that a game company was careless. It is that the weakest link in a customer's experience of your security may be a company they have never heard of.

Evidence

Two independent sources:

• BleepingComputer: Valve notifies Steam hardware customers of a data breach
• Help Net Security: Cyberattack on Steam hardware shipper leaks names, addresses, and order data

What this means for your team

Map the vendors that hold your customer data even when they never touch your core systems, and rank them by the number of customers each one could expose in a single incident. For the concentrated ones, agree breach-notification timelines and evidence-sharing terms in the contract, not in the middle of an incident. Then prepare the customer-facing side in advance: a template notice that states what a legitimate message from you will and will not ask for, and a public reminder that you never request payment to release a delivery. Doing this before an event turns a scramble into a script. If this is a live question for you, it is worth comparing notes with peers on third-party and vendor risk management rather than reinventing the playbook alone.

LexisNexis pulls Diligence, Metabase API, and Newsdesk offline after vendor server activity

What happened

The notable part of this story is the choice, not the intrusion. Faced with suspicious activity on infrastructure it does not run itself, LexisNexis pulled the affected services down rather than watch and wait. That is an expensive decision. Diligence supports compliance and due-diligence work, and the data feeds behind these products are wired into customer systems, so an outage ripples outward. Taking them offline anyway signals a judgment that continued exposure was the larger risk, and that rebuilding in a clean environment was safer than trusting the compromised one.

It also underlines how much containment depends on a vendor you do not control. LexisNexis could disconnect, but the servers, the forensic picture, and the timeline sit partly with the third party that hosts them. The company was careful to separate this event from an unrelated Metabase Cloud vulnerability making news the same week, a useful reminder that similar-sounding names invite false links during an active incident. For a data broker with two prior disclosures in just over a year, the pattern worth watching is less any single flaw than the recurring exposure of data held in systems at the edges of its own estate.

Evidence

• BleepingComputer: LexisNexis shuts down services after suspicious activity on servers
• SC Media: LexisNexis services offline due to unusual activity on third-party vendor servers

What this means for your team

Decide now which services you would take offline in response to a suspected compromise, and make sure someone has the authority to make that call under pressure. A containment plan that assumes you will keep everything running is not a containment plan. Extend that thinking to hosted vendors: for the third parties that run systems on your behalf, confirm you can force a disconnect, obtain forensic data, and rebuild in a clean environment without waiting on their timeline. Practice the trade-off between availability and containment as a tabletop, because the pressure to keep a revenue-generating service up is exactly what attackers count on.

Poisoned vendor data feed turns seven BdThemes WordPress plugins into a backdoor

What happened

This attack sidesteps the defenses most teams rely on for plugins. Nobody pushed a malicious update, so a site that pinned versions or reviewed release notes gained nothing. The malicious content arrived through a data feed that a trusted plugin quietly fetches in the background, which means the code an administrator was running never changed, only the instructions it received. Because the payload executes in the administrator's own authenticated session, it inherits full privileges and can create accounts, drop a web shell, and hide its own tracks without tripping the usual signals.

The design choices show intent to persist quietly. Hidden administrator accounts, a login backdoor tied to a URL parameter, and a module that scrubs the rogue users from the admin list all aim at long-term, low-visibility access. The severity rating on the underlying flaw is only medium, which is a useful caution: a modest client-side bug becomes a serious problem once an attacker controls the data source that triggers it. The initiating failure here was upstream, at the vendor's cloud storage, and every downstream site inherited the consequences.

Evidence

• The Hacker News: BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
• BleepingComputer: BdThemes plugins supply-chain hack creates rogue WordPress admins

What this means for your team

If your marketing or web team runs WordPress with any of the named plugins, treat affected sites as potentially compromised, not merely in need of an update. Look for administrator accounts you did not create, unexpected must-use plugins, and new files in the web directory, and rotate credentials once the site is clean. More broadly, take the pattern seriously: components that pull remote content into a privileged context are a live supply-chain path, so know which of your third-party plugins and integrations phone home, and restrict who and what can reach an admin session. This is a good topic to work through with peers on software supply-chain security, since the same design shows up well beyond WordPress.

FAQ

What data did the Valve and CEVA Logistics breach expose?

The stolen records include names, postal addresses, phone numbers, email addresses, and the type and price of Steam hardware ordered by customers in Europe. Valve says payment details, Steam passwords, and Steam Guard codes were not involved because CEVA Logistics did not hold that data, and affected customers do not need to change their Steam password.

Why did Valve customers receive phishing warnings?

The stolen shipping data lets attackers craft scams that quote a real name, address, and recent order. Valve warned customers to expect fake delivery, customs-fee, refund, or account-verification messages by email, SMS, or phone that impersonate Steam or delivery companies, and to treat any request for payment or login as fraudulent.

Was the LexisNexis outage caused by a data breach?

LexisNexis took its Diligence, Metabase API, and Newsdesk services offline after identifying unusual activity on servers run by an unnamed third-party vendor. It disconnected from those systems to contain the issue and is rebuilding them with a forensic firm. It has not confirmed data theft, and it says the incident is unrelated to the Metabase Cloud zero-day disclosed on August 6.

How does the BdThemes WordPress supply-chain attack work?

Attackers gained write access to a cloud storage bucket that feeds promotional banners into seven BdThemes plugins and replaced the legitimate JSON with a malicious payload. A cross-site scripting flaw rated CVSS 5.4 then runs the payload in the browser of any logged-in administrator, creating rogue admin accounts and installing a PHP web shell, with no plugin update or on-disk file change required.

What is the main CISO takeaway from the August 10 briefing?

Third-party and supply-chain exposure defined the day. A logistics vendor breach became a customer phishing problem for Valve, a hosting vendor's servers forced LexisNexis to pull core services offline, and a poisoned vendor data feed turned trusted WordPress plugins into a backdoor. Inventory the vendors that hold your data or run code in your environment, and plan for their incidents as if they were your own.