AI Weekly Malaysia

A cyberattack on CEVA Logistics between July 29 and August 1 disrupted eight European warehouses and exposed customer data from major clients including Valve, Bol, ING, and Ajax. Valve confirmed attackers likely stole names, addresses, phone numbers, emails, and order details for Steam hardware customers, though no payment info or passwords were exposed since CEVA doesn't hold them. Bol halted data exchanges with CEVA and took affected fulfillment center products offline, with some orders canceled or delayed.

Why: If you ship physical products through a third-party logistics provider, this is your template for what goes wrong: your fulfillment partner holds customer PII you can't fully control, and a breach there becomes your customer communication problem. The practical move is to audit what data your logistics/fulfillment vendors actually retain and for how long — Valve noted CEVA keeps it for 90 days — and push contractually for shorter retention and minimal data fields. Also worth reviewing whether your vendor risk process covers the phishing fallout scenario Valve described, where attackers quote real order details back to customers.

Ceva Logistics, a France-headquartered shipping giant with $18.3B revenue and over 1,000 warehouses, was hacked starting July 29, affecting at least 8 European warehouses and causing shipping delays. Customer personal data (names, addresses, phone numbers, emails) was stolen for clients including Bol, De Bijenkorf, Ajax, ING, Ace & Tate, and Valve/Steam, with Valve notifying customers on August 7.

Why: If you ship physical goods through third-party logistics providers, this is a concrete reminder that your customer PII lives in systems you don't control — and that a breach at your warehouse partner becomes your breach notification problem. Review what customer data your fulfillment or shipping vendors can access and whether you're contractually obligated to notify customers when that vendor is compromised, as Bol and Valve had to do here.