Ceva Logistics Breach Exposes Customer Data Across European Retail

The incident began on July 29, severely impacting the supply chain for companies that rely on the France-headquartered logistics firm to move products from assembly lines to households. While Ceva maintains over a thousand warehouses globally, the company claims the operational fallout is currently restricted to eight European facilities. Despite these assurances, the scale of the data theft remains significant, with hackers accessing names, home addresses, phone numbers, and email addresses from internal systems.

Retailers and partners are now grappling with the aftermath. Dutch giant Bol has warned customers of potential order cancellations and delays, a sentiment echoed by luxury retailer De Bijenkorf. The breach has also reached the technology sector; Valve notified Steam hardware customers that their delivery information, stored by Ceva for 90 days post-purchase, was exposed during the intrusion. Other affected entities include banking giant ING, football club Ajax, and eyewear brand Ace & Tate.

Ceva spokesperson Ryan Fisher declined to clarify whether a ransom demand has been issued or to provide an estimate on the total number of individuals impacted. While the company stated that its cybersecurity teams activated emergency protocols and restored some services, its primary website remained unstable as of Monday. Dutch authorities are reportedly investigating the breach, though officials from the local data protection agency have yet to comment on the scope of the inquiry.