CEVA Logistics cyberattack

On 11 August 2026, reporting confirmed that a cyberattack on CEVA Logistics — the France-based global freight and contract-logistics operator — had disrupted eight of its European warehouses and exposed customer shipment data belonging to a chain of downstream clients. Because CEVA handles fulfilment and delivery on behalf of many retailers, the breach rippled outward: Valve's Steam hardware store, Dutch e-commerce group Bol, luxury department store De Bijenkorf, eyewear brand Ace & Tate and football club Ajax were among those reported affected.

What happened

Attackers accessed CEVA's systems between 29 July and 1 August 2026. On 1 August, CEVA told European retailers that the intrusion had disrupted operations at eight of its European warehouses, causing shipping delays. As the investigation progressed, it became clear that customer and shipment information processed by CEVA on behalf of its clients had also been exposed.

For Steam customers in Europe, Valve said it learned of the incident on 7 August and later notified affected buyers. The exposed data included names, postal addresses, phone numbers, email addresses, and the type and price of ordered products. Valve stated that passwords, payment-card numbers and Steam Guard two-factor codes were not affected, because that data is not shared with the shipping partner.

CEVA isolated the affected systems, took them offline, and engaged outside investigators. Valve said it was pressing CEVA for more detail on what was taken and how the breach occurred, and was notifying data-protection authorities in the affected countries.

Impact

• Operational disruption at eight European warehouses, causing shipment delays across multiple retail brands.
• Customer shipment data — names, addresses, phone numbers, emails and order details — exposed for buyers of several downstream clients, including Steam hardware purchasers in Europe.
• No evidence that passwords, payment cards, or two-factor codes were compromised.

Why it matters

The CEVA breach is a textbook illustration of third-party logistics risk: a single compromise at a shared fulfilment provider cascades to the customers of every brand it serves, none of which were themselves breached. For consumers, the exposure of name, address, phone and specific purchase details is a strong basis for targeted, convincing phishing and package-delivery scams. It underlines that retailers' data-protection obligations extend to the security posture of their delivery and fulfilment partners, and that a logistics operator sits on a concentration of personal data whose blast radius reaches far beyond its own customer list.