Ceva Logistics breach spreads to retailers, banks and Steam hardware buyers
A cyberattack on Ceva Logistics, one of the world's largest freight and warehousing companies, has exposed customer shipping data held for a string of European retailers and brands, including Valve's Steam hardware store, the Dutch retailer Bol and the bank ING, TechCrunch reported on Aug. 10.
The incident shows how one logistics provider can become a single point of failure for many companies. Customers who never dealt with Ceva directly are now receiving breach notices because the firm handled their orders.
What happened
The intrusion began on July 29, according to FreightWaves. Ceva told affected business customers on Aug. 1 that a cyber intrusion was affecting part of its European contract logistics operations. The company said the operational impact was limited to eight warehouses and that no other systems around the world were affected. It said some applications were back online and that it was working with authorities.
Several companies said the attackers obtained customers' names, home addresses, phone numbers and email addresses. Bol warned of delays and some cancelled orders. Luxury retailer De Bijenkorf confirmed delays and data theft. Valve said it learned on Aug. 7 that data on recent hardware buyers was taken; Ceva keeps shipping data for 90 days after an order. Football club Ajax, ING and eyewear retailer Ace and Tate also said shipping information was affected. The Dutch data protection authority received breach reports from 10 organizations.
Pokémon Center later began notifying customers in the U.K. and Germany that names, addresses, phone numbers, email addresses and order contents were stolen, and cancelled some orders, BleepingComputer reported. It said payment card details were not exposed because Ceva does not have access to them.
What we don't know yet
Ceva, which is headquartered in France and runs more than 1,000 warehouses, declined to say how much personal data was taken or whether the attackers demanded a ransom. No group has been publicly identified.
What to do
Anyone who ordered from the affected brands in Europe this summer should watch for fake delivery notices and parcel scams that quote real order details. Businesses should ask logistics partners how long they keep customer data and how quickly they will report an incident.
