Anyone who ordered Steam hardware in the last ~3 months in Europe just had their names, address, phone number and email stolen
(sh.itjust.works)
Someone must have clicked a link and it wasn't a training email. Then entered their information.