CEVA Logistics cyberattack exposes customer data across Europe

Full text

CEVA Logistics hack disrupted European warehouses and exposed some customer data

Retailers and Valve reported compromised delivery information and service delays

Clients warned of targeted scams while awaiting fuller incident details from CEVA

CEVA Logistics, one of the biggest shipping and logistics companies in the world, has suffered a major cyberattack, the effects of which are trickling down to many of its clients.

The details of the hack itself, however, are not yet publicly available and what little information is out there came from the affected clients themselves.

CEVA has not yet issued an official statement, or filed a report with the regulators, but confirmed to TechCrunch that the attack most likely started on July 29, 2026, and affected at least eight warehouses across Europe.

Technical details missing, affected customers step forward

CEVA Logistics is a global logistics and supply-chain company and a wholly owned subsidiary of CMA CGM, a French shipping giant. It provides freight forwarding, contract logistics, warehousing and transportation services to thousands of customers, including major companies in the consumer and retail, automotive, industrial and aerospace sectors.

The company operates in more than 170 countries around the world and last year it generated $18.3 billion in gross revenue, so it is a major player and a key target for attackers.

The details about the incident itself are scarce right now. We don’t know how the crooks broke in (via a successful social engineering attack, or by abusing a software vulnerability, for example), how much data they stole, or if they demanded a ransom payment in exchange for deleting the stolen goods. From one of the victims, though, we have learned that some data was most likely compromised.

When the effects of a cyberattack spill into the physical realm (as is the case here with eight affected warehouses) we can speculate the attack was either ransomware , or disruptive malware . Companies shut down parts of their IT infrastructure only when there is no other way to clear an infection or remove malicious outsiders.

In the meantime, a small number of CEVA’s customers confirmed suffering an attack and losing sensitive data.

Among them is Bol, a Dutch online retail company, which said the incident affected two systems used for processing orders from one of its fulfillment

“No bol systems were affected,” it said. “However, data of customers whose orders were processed via this location may have been viewed or copied.”

Bol also said restoring operations at one of CEVA’s locations was taking longer than anticipated. As a result, the assortment stored at the affected location was taken offline, and the products were unavailable for sale. Also, Bol is currently unable to receive goods from suppliers and sales partners at that location.

A similar announcement was given by De Bijenkorf, another Dutch luxury retailer, who said that order processing, returns, and refunds, might take longer, but stressed that its stores remained open. It also said that some customer data may have been compromised, including names, contact details, online orders data and, in some cases, VAT numbers. Payment information, bank account numbers (IBANs), credit card information, usernames, or passwords, were not compromised, it was confirmed.

Valve steps forward

Retail giants aside, PC gaming powerhouse Valve also notified its customers about the incident. It said CEVA ships Steam hardware to its European customers and as such, receives specific delivery-related information from Steam.

This information, which CEVA retains for up to 90 days after the order, was most likely compromised. It includes names, street addresses, phone numbers, email addresses, and the type and price of ordered products.

Valve warned its customers to expect fake messages, either via email, SMS, or phone, that might mention recent hardware orders.

“They may quote your address back to you to prove they're genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to “verify” your order. Treat all of them as fake,” Valve warned. The company also stressed that customer accounts are safe and that users need not do anything to secure them.

Other details are missing, not just for the general public, but for the affected CEVA clients, as well. Valve said it was “pressing” the company for the full scope of what was taken and how, and added that it is notifying the relevant authorities, as well.

A spokesperson of the Dutch data protection authority, Mark Schenkel, told TechCrunch the agency so far received 10 incident reports. Given the size of CEVA, it’s safe to assume there will be others.