Cyberattack on logistics giant CEVA delivers customer data into the wrong hands

ID: 13096
Status: summarized
Published: 11 Aug 2026, 9:24 PM
Fetched: 11 Aug 2026, 10:26 PM
Provider: The Register
Category: technology
Original URL: https://www.theregister.com/cyber-crime/2026/08/11/cyberattack-on-logistics-giant-ceva-delivers-customer-data-into-the-wrong-hands/5286229
Source URL: https://www.theregister.com/headlines.atom

Summary

Score: 5.5
Created: 11 Aug 2026, 10:27 PM
Tags: supply-chain-security data-breach third-party-risk logistics
Audience: saas_foundersdevelopers

What happened

A cyberattack on CEVA Logistics between July 29 and August 1 disrupted eight European warehouses and exposed customer data from major clients including Valve, Bol, ING, and Ajax. Valve confirmed attackers likely stole names, addresses, phone numbers, emails, and order details for Steam hardware customers, though no payment info or passwords were exposed since CEVA doesn't hold them. Bol halted data exchanges with CEVA and took affected fulfillment center products offline, with some orders canceled or delayed.

Why it matters

If you ship physical products through a third-party logistics provider, this is your template for what goes wrong: your fulfillment partner holds customer PII you can't fully control, and a breach there becomes your customer communication problem. The practical move is to audit what data your logistics/fulfillment vendors actually retain and for how long — Valve noted CEVA keeps it for 90 days — and push contractually for shorter retention and minimal data fields. Also worth reviewing whether your vendor risk process covers the phishing fallout scenario Valve described, where attackers quote real order details back to customers.

Discussion angle

What data do you actually hand to your fulfillment or shipping partner, and could you reduce it to the point where a breach like this doesn't expose customer contact details? Compare Valve's position (CEVA never had payment data or passwords) versus the PII that did leak — which side of that line is your own vendor stack on?