CEVA Logistics cyberattack affects eight European warehouses

CEVA confirms European logistics intrusion

CEVA Logistics has confirmed that a cyberattack affected part of its European contract logistics operations, disrupting eight warehouses and exposing delivery-related customer information held for clients. The France-headquartered logistics company said it confirmed the intrusion to affected customers on August 1 after the incident was identified.

Several organisations that use CEVA for warehousing and delivery have warned customers that personal data may have been taken. Reported information includes names, home addresses, phone numbers and email addresses used when placing orders. The affected organisations include Dutch retailer Bol, luxury retailer De Bijenkorf, football club Ajax, ING, Ace & Tate, and Valve customers who had recently bought Steam hardware.

FreightWaves reported that the attack began on July 29 and was causing delivery delays for goods in the affected facilities. Bol has said it expects delays and that some orders may be cancelled. De Bijenkorf also confirmed order delays following the theft of customer data.

Scope, recovery and unanswered questions

CEVA said the operational impact was limited to eight warehouses and that no other CEVA systems globally were affected. All other operations were continuing without incident, it said. Some affected applications and services were back online as the company worked with authorities and continued its investigation.

The company has not disclosed how much personal information was taken or whether it has received communications from the attackers, including a ransom demand. Authorities in the Netherlands are reportedly investigating the incident.

Valve told customers it learned on August 7 that data had been taken from CEVA systems. In its customer notice, Valve said CEVA stores shipping and delivery information for 90 days after an order. That retention period illustrates how delivery providers can hold information that remains useful to both fulfilment operations and an incident response.

Third-party exposure extends beyond the warehouse

CEVA generated $18.3 billion in revenue in 2025 and operates more than 1,000 warehouses worldwide. The episode shows how a breach at a logistics provider can extend simultaneously to retailers, financial institutions, consumer brands and hardware vendors that share delivery details with the same operational partner.

For businesses, the practical implication is to treat customer delivery data at logistics suppliers as a material third-party risk: maintain clear incident contacts, understand data-retention practices, and ensure notification and fulfilment-continuity procedures can be activated when a warehouse operator is disrupted.