Ceva Logistics Breach Exposes Customer Data Across Eight European Warehouses

Per Häggdahl

August 13, 2026 5 min read

A cyberattack on Ceva Logistics has hit eight European warehouses, disrupted shipments for major retailers and exposed customer data belonging to a range of companies that depend on the logistics giant for their supply chain operations. The breach is rippling outward and affected parties include European retailers, banks and Steam users whose data passed through Ceva’s contract logistics systems.

Ceva confirmed the incident to affected customers on 1 August, telling them that a cyber intrusion was impacting part of its European contract logistics operations. The company has not filed a public disclosure beyond that customer notification. Air, ocean, ground and rail transportation continued without reported interruption. The disruption was contained to the contract logistics division which handles warehousing and fulfilment on behalf of third-party clients.

That distinction matters less than it sounds. Contract logistics is where the customer data sits.

What Was Taken and Who Is Affected

The full scope of the data exposure is not yet confirmed. Bol, de Bijenkorf and Ace & Tate has been named among the retailers whose customer data was caught in the breach. TechCrunch reported that Steam users were also affected meaning Valve’s logistics fulfilment arrangements with Ceva have pulled gaming customers into an incident they have no direct relationship with.

The Register reported on 11 August that customer data had reached the wrong hands though the specific data categories involved have not been publicly confirmed by Ceva. No CVEs have been disclosed and the attack vector has not been identified in any official statement. The perpetrators remain unknown and no group has publicly claimed responsibility as of the time of writing.

Ceva told TechCrunch it has activated its security protocols and is conducting a thorough investigation. That phrase tells us almost nothing about what controls failed or how the intrusion entered the network.

Why Logistics Breaches Are Structurally Worse Than They Look

Third-party logistics providers sit at the intersection of dozens of data flows including retailer inventory records, end-customer names and addresses, payment references, order histories. A company like Ceva does not just move boxes. It holds a live mirror of its clients’ customer databases, updated with every shipment.

That is why the downstream list here is so varied. Bol is a major Dutch e-commerce platform. De Bijenkorf is a premium Dutch department store. Ace & Tate is a European eyewear retailer. Steam is a global gaming distribution platform. These organisations share almost nothing in common except that they all handed Ceva logistics data and Ceva now appears to have lost control of it.

Supply chain attacks on logistics intermediaries are particularly effective precisely because the intermediary holds aggregated data from multiple clients simultaneously. One breach, multiple victims. Security teams at the affected retailers are now managing an incident they did not cause and cannot fully investigate.

The Nordic Exposure

Ceva Logistics operates warehouse and contract logistics facilities across the Nordic region. Ace & Tate has a significant Nordic retail presence with stores across Sweden, Denmark and Norway. Customers who ordered from Ace & Tate and had their fulfilment handled through Ceva’s European contract logistics network should treat their order and contact data as potentially compromised until Ace & Tate provides a specific confirmation otherwise.

Any company in the Nordic region using Ceva for warehousing or fulfilment services should request a written incident report from Ceva under GDPR Article 33 which requires data processors to notify controllers without undue delay when a breach is confirmed. Waiting for Ceva’s public communications is not sufficient under the regulation.

Steps for Affected Customers

If you have placed an order with any retailer that uses Ceva Logistics for European fulfilment, the exposure risk is real. The stolen data likely includes names, delivery addresses and order details. That is enough for targeted phishing. Any delivery notification arriving by email or SMS in the coming weeks deserves extra scrutiny regardless of how legitimate it looks.

Retailers affected by the breach are obligated to notify customers whose data was exposed under GDPR. If you have not received a notification from a retailer and believe you placed an order fulfilled through Ceva, contact the retailer’s customer service team directly and ask whether your data was involved. Document the response.

For corporate procurement and supply chain teams, if Ceva is a contract logistics provider in your supplier register, request their incident report now. Your own GDPR notification obligations as a data controller may be triggered by what that report contains and the 72-hour clock under Article 33 runs from the point you become aware, not from the point Ceva chooses to tell you.

The investigation is ongoing. No ransomware group has claimed the attack. No attack vector has been disclosed. Those are three large unknowns for a breach that has already confirmed customer data exposure across multiple countries and that combination should make any organisation with a Ceva contract logistics relationship more impatient for answers than the company’s public statements currently justify.