On 10 August 2026, TechCrunch reported that CEVA Logistics, the France-headquartered shipping company, had been hacked and that the fallout was reaching its customers' customers. CEVA told TechCrunch that "a cyber intrusion was impacting part of its European contract logistics operations." FreightWaves reported the intrusion began on 29 July.
What's affected
Per TechCrunch's reporting:
- CEVA says at least eight warehouses in Europe are affected. It confirmed the intrusion to affected customers on 1 August and said "No other CEVA systems globally were affected."
- Several companies said hackers took customer names, home addresses, phone numbers and the email addresses used to place orders.
- Bol, the Dutch online retailer, said its warehousing partner was accessed and that customer data may have been taken. De Bijenkorf confirmed order delays. Ajax, ING and Ace & Tate said customers' shipping information was affected.
- Valve learned of the theft on 7 August and notified customers who recently bought Steam hardware. Valve said CEVA keeps shipping and delivery information for 90 days after an order.
- The Dutch data protection authority said it had received breach reports from 10 organizations related to the incident.
TechCrunch did not identify the attackers or the cause of the intrusion, and CEVA declined to say how much personal data was taken or whether it had been contacted by the hackers. We have no more detail than that, so this post sticks to what was reported.
How to check if you're exposed
This is a data-handling question, not a package question. Build a short table of every vendor that holds personal data on your behalf:
| Vendor | Data they receive | Why they need it | How long they keep it | Breach notice deadline in contract |
|---|---|---|---|---|
| Warehouse or shipping partner | Name, address, phone, email | Label and delivery | Ask | Ask |
| Email or SMS provider | Email, phone | Notifications | Ask | Ask |
| Support tooling | Name, email, order history | Tickets | Ask | Ask |
Fill every "Ask" from the contract or a direct question. A retention period you cannot state is a finding.
What to do now
- List the logistics, fulfilment and carrier partners you use and the exact fields you send each one.
- Ask each for its retention period, and for written confirmation of whether it was affected by this or any similar incident.
- Prepare a customer notice template for delivery-data exposure. Reports say the stolen data is the kind used for phishing, so tell customers what you will never ask for by email or text.
- Check your contracts for a breach notification deadline. Valve says it learned of the theft on 7 August, while reports date the intrusion to 29 July.
- Brief support teams on expected delivery delays and cancellations, which Bol said to expect.
How this could have been avoided
Nothing public says how the intrusion happened, so these are controls on the customer side of the relationship, not claims about CEVA's systems.
- Send the minimum. A carrier needs a delivery address and a contact route, not necessarily a full email address, order history or date of birth.
- Cap retention. Valve noted a 90-day retention at the partner. Ask whether that can be 30, or whether records can be deleted after delivery confirmation.
- Pseudonymize where possible. A reference ID in place of a name and email reduces what a partner breach can reveal.
- Put a notification deadline in the contract. The gap between a vendor's discovery and your own awareness is time your customers spend exposed.
- Test the notice path. Run a tabletop exercise on a partner breach once a year, so the first draft is not written under pressure.
Why it matters
Companies as different as a retailer, a bank and a game store found their customers' data in the same warehouse partner. None of them ran the warehouse systems, and yet each had to send its own notice and answer its own regulator. A vendor breach is your breach in the eyes of your customers.
The practical lesson is boring and effective: know which fields leave your building, who holds them, and for how long.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why did Valve and ING have to notify customers when CEVA was the one breached?
They had sent their customers' shipping data to CEVA. The data subjects are their customers, so the notification duty sits with them even though the intrusion was at a partner.
What is the cheapest control that would have reduced the impact?
Sending fewer fields and keeping them for less time. Data a partner never holds cannot be exposed in a partner breach.
