Ceva Logistics Breach Hits Eight European Warehouses and Exposes Customer Data
Ceva Logistics says a cyberattack hit eight European warehouses, exposing customer shipping data and delaying orders for Bol, Valve, ING and other firms.
Summary
A cyberattack on France headquartered Ceva Logistics began July 29, 2026, FreightWaves reported, disrupting eight European warehouses and delaying goods. Ceva, which earned $18.3 billion in 2025 and operates more than 1,000 warehouses worldwide, notified affected customers on August 1. It said the intrusion was confined to part of its European contract logistics operation, with all other global systems unaffected. Some applications and services were restored, but Ceva’s website was not loading properly when TechCrunch published on August 10.
Hackers took names, home addresses, phone numbers and email addresses from Ceva’s delivery systems. Bol warned of delays and cancellations, De Bijenkorf confirmed data theft and delays, and Ajax, ING and Ace & Tate reported exposed shipping information. Valve learned of the breach on August 7 and alerted recent Steam hardware buyers, whose delivery data Ceva retains for 90 days; spokesperson Doug Lombardi did not comment. Mark Schenkel said the Dutch data protection authority received related breach reports from 10 organizations, while Dutch authorities investigate. Ceva activated security protocols and is cooperating with authorities, but spokesperson Ryan Fisher would not disclose the data volume or whether attackers communicated or demanded ransom. Logistics companies are growing targets because criminals can exploit their access to trucks and containers.
Positives
- Ceva said the operational disruption was limited to eight European warehouses, with no other global systems affected.
- Some affected Ceva applications and services have returned online.
- Ceva activated its security protocols, launched an investigation and began cooperating with authorities.
- 10 related breach reports reached the Dutch data protection authority, and authorities in the Netherlands are investigating.
Risks & concerns
- The attack began July 29 and caused shipment delays across multiple European warehouses.
- Names, home addresses, phone numbers and email addresses were stolen from Ceva’s delivery systems.
- Bol expects delayed and canceled orders, while De Bijenkorf also confirmed fulfillment disruptions.
- Valve warned recent Steam hardware buyers that delivery information retained for 90 days was compromised.
- Ajax, ING and Ace & Tate reported that customers’ shipping information was affected.
- Ceva has not disclosed the stolen data volume or whether attackers contacted it or demanded ransom.