Ceva Logistics Data Breach Sends Shockwaves Through Banks, Retailers, and Steam Gamers
Ceva Logistics, one of the leading global logistics and shipping firms, has fallen victim to a cyberattack. Various companies that utilize Ceva’s services for shipping have reported that sensitive customer data was compromised during the breach.
The cyber incident is impacting at least eight warehouses across Europe, which are essential for distributing goods, as confirmed by the company.
According to reports, the breach began on July 29 and has resulted in significant shipping delays for merchandise stored in the affected facilities.
Headquartered in France, Ceva is a major player in the logistics sector, helping businesses transport products from production sites to consumers’ doorsteps. The company achieved revenue of $18.3 billion in 2025 and operates over a thousand warehouses globally.
In recent years, shipping and logistics companies have increasingly become targets for cybercriminals due to their capability to access valuable shipments and manipulate deliveries.
The cyberattack on Ceva also led to a data breach, with hackers obtaining significant amounts of personal information belonging to retail clients relying on Ceva for their shipping needs. Several businesses reported that attackers accessed customer names, home addresses, phone numbers, and email addresses linked to their orders.
Dutch online retailer Bol issued a cautionary statement, indicating that hackers infiltrated its warehouse partner Ceva and may have accessed customer data. They also anticipated delays and potential cancellations of orders due to this incident.
Another luxury retailer, De Bijenkorf, confirmed that delays in order fulfillment were a result of the data breach. Other affected companies include the football club Ajax, banking institution ING, and eyewear brand Ace & Tate, all of which reported disruptions in customer shipping information.
Video game company Valve informed its consumers that it became aware of the breach on August 7, indicating that personal details from the customers who purchased its Steam hardware were compromised. Valve communicated via Reddit that Ceva retains shipping and delivery data for 90 days post-order.
A spokesperson for Valve did not respond to inquiries regarding the incident.
Ceva has acknowledged the cyberattack in an official statement.
“On August 1, CEVA Logistics informed impacted clients about the cyber intrusion affecting part of its logistics operations in Europe. Upon identification of the issue, CEVA’s cybersecurity team activated security measures and commenced a comprehensive investigation, which remains ongoing,” the statement revealed. “The operational disruption is confined to eight warehouses, with no impact on other CEVA systems worldwide, allowing all other services to proceed without issue.”
Ryan Fisher, a spokesperson for Ceva, did not provide further details about the incident, such as the amount of personal data stolen or if any ransom demands have been made.
Ceva mentioned that some of its affected services are being restored and that they are collaborating with law enforcement. At the time of publication, Ceva’s website was experiencing accessibility issues.
Investigations into the breach are reportedly being conducted by authorities in the Netherlands.
Mark Schenkel, a spokesperson for the Dutch Data Protection Authority, did not respond to requests for comments regarding the situation.
