August's Breach Wave: Valve, Levi's, and Where Your Leaked Data Actually Goes

August 2026 has been a brutal month for data breaches — and if you use Steam, shop online, or have ever had a package shipped to your door, some of your personal information was almost certainly caught up in it.

Here's a quick tour of what happened, and the part almost every breach notice leaves out: where your leaked data actually goes.

The August breach wave

Valve (Steam). Valve notified Steam hardware customers that their data was stolen — but not from Valve's own systems. Attackers breached Valve's shipping partner, CEVA Logistics, and walked off with customer names, addresses, phone numbers, email addresses, and order details. No passwords or payment information were taken, and Valve is urging customers to watch for phishing that uses the stolen details.

Levi Strauss & Co. Levi's disclosed a breach in an SEC filing after attackers used social engineering — a handful of phone calls that manipulated three employees — to get into corporate systems. Levi's says no consumer data was affected, but the method is the lesson: modern breaches manipulate people, not just code.

The Salesforce wave. A string of companies had millions of customer records stolen through breaches tied to the ShinyHunters group targeting Salesforce environments. Most of the affected people had never heard of the vendors holding their data.

The thread that connects them

Notice the pattern: in most of these breaches, your data wasn't stolen from a company you chose. It was sitting in a shipping partner, a marketing platform, a vendor three steps removed from you — because that's how the modern data economy works. Your name, address, and phone number are copied, shared, and stored across dozens of companies you never signed up with.

You can't audit every vendor that touches your information. And you can't un-leak a breach once it happens.

What the notice won't tell you

Every breach notice answers one question — what was taken — and skips the one that matters most: where does it go next?

A leaked name and address doesn't stay in the breach. It gets cleaned up, packaged, and resold. Within weeks it can resurface on the people-search sites — the Spokeos, Whitepages, and Radarises of the world — where anyone can type your name and pull up your address, phone, relatives, and history for a few dollars. That's the same raw material behind the scam calls that already know your name and the "fraud alert" texts with your address on them.

The breach isn't the end of the story. It's the start of a supply chain that ends with your information for sale.

What you can actually do

You can't control every company that holds your data. But you can control how much of you is findable — and that's the lever that actually reduces your risk from the next breach:

• Check what leaked. Run your email through Have I Been Pwned to see which breaches you're already in, and change the passwords on anything it flags — starting with your email.
• Watch for breach phishing. After a breach, expect emails and texts that name-drop the breached company and push you to "verify" fast. The tell is urgency plus a link. Don't click — go to the site directly.
• Shrink your footprint. The less of your personal data that's public on people-search sites, the less a stranger — or a scammer working off a breach — can assemble about you.

That last one is what we do at GhostMyData: we find where your personal information is listed across data-broker and people-search sites and remove it, automatically. A leaked record can't do much damage if there's no public profile for it to attach to.

The breaches will keep coming. What you can change is how much of you is out there when they do.

See what's already public about you — free scan →