Ceva Logistics hack exposed customers' data across banks, retailers and Steam buyers

On 2026-08-10 TechCrunch reported that Ceva Logistics, a France-headquartered shipping and logistics giant with $18.3bn in 2025 revenue and more than a thousand warehouses worldwide, had been hacked. The intrusion, which industry site FreightWaves dated to July 29, affected at least eight warehouses across Europe used to ship goods across the continent, and caused shipping delays for goods in the affected sites.

The attack also became a data breach for Ceva's retail clients: hackers took customers' names, home addresses, phone numbers and email addresses from Ceva's systems. Dutch online retailer Bol warned its customers and expected delays and some cancelled orders; De Bijenkorf confirmed order delays; Ajax, banking giant ING and eyeglass maker Ace & Tate all reported customers' shipping information was affected. Valve said it learned on August 7 that data had been taken and alerted recent Steam hardware buyers, noting Ceva stores their shipping information for 90 days after an order.

Ceva confirmed the cyber intrusion on August 1 in statements to affected customers and TechCrunch, saying its security protocols were activated immediately and that impact was 'limited to eight warehouses' with no other global systems affected. Its spokesperson declined to say how much personal data was taken or whether a ransom demand had arrived, and the company's website was not properly loading as of publication. The Dutch data protection authority said it had received breach reports from 10 organisations, and Dutch authorities were investigating.

Personal data of retail customers of at least 10 organisations reported to the Dutch regulator; shipping delays and cancelled orders

Logistics giants have become prime cybercriminal targets because they can divert trucks and containers of real goods

Ceva's systems held one shared store of retail customers' delivery data across many brands, so one breach rippled through all of them

The company stayed tight-lipped on scope, ransom and data volumes while customers had to do the notifying

When you sit in the middle of everyone's supply chain, your security debt becomes every customer's breach

As of 2026-08-10 some affected Ceva applications and services were back online, an investigation with authorities was ongoing, and the Dutch data protection authority had breach reports from 10 organisations tied to the incident.