NOTABLENATOB1incident

One compromised contract-logistics processor put ten organisations into breach notification at once — CEVA Logistics, eight European warehouses, and a bank, a retailer and a games platform all learning from their supplier

discovered 2026-08-11 04:50 UTCrun 2026-08-11T0411Z-intel3 sourcesmulti-source

CEVA Logistics — a contract-logistics operator that has been part of the French shipping group CMA CGM since 2019 (ICTMagazine.nl, 2026-08-10) — confirmed to affected customers on 1 August 2026 that a cyber intrusion was affecting part of its European contract-logistics operations, telling TechCrunch that its security teams activated protocols and opened an investigation that is still running, and that the operational impact was limited to eight warehouses, with no other CEVA systems globally affected (TechCrunch, 2026-08-10). That is the whole of what the compromised party has said publicly. Dutch trade reporting records that CEVA itself has given no public reaction of its own to these incidents (ICTMagazine.nl, 2026-08-10), and its spokesperson declined to answer whether the company knows how much personal data was taken or whether it has heard from the intruders at all, including on a ransom demand (TechCrunch, 2026-08-10).

The reason this is an entry rather than one more breach is arithmetic. CEVA processes fulfilment and shipping data for many unrelated clients, so one intrusion at one processor created independent notification duties at each of them simultaneously: the Dutch data-protection authority's spokesperson confirmed to TechCrunch that it has received breach reports from ten organisations in relation to this single incident. The named downstream parties span sectors that share nothing but a logistics contract — ING in banking, bol.com and De Bijenkorf in retail, the football club AFC Ajax, the eyewear retailer Ace & Tate, and Valve, which told customers it learned on 7 August that data was taken from CEVA's systems and alerted customers who had recently bought its Steam hardware, noting CEVA holds their shipping and delivery information for 90 days after an order (TechCrunch, 2026-08-10); Dutch trade reporting scopes those Steam buyers to Europe (ICTMagazine.nl, 2026-08-10).

bol.com's own notice is the most specific account any party has published. It records that it was informed on 1 August, that the incident involves two systems used for processing orders from one of its fulfilment centres, that no bol systems were affected, and that data of customers whose orders were processed via that location may have been viewed or copied (bol.com, 2026-08-06). It also records the containment sequence — the logistics partner moved to stop the unauthorised access and brought in external specialists, and bol proactively halted data exchange with it pending assurance that resuming is safe — and the part that is easy to miss in a data-breach framing: the affected location's stock was taken offline, goods could not be received there, and orders were cancelled or delayed while restoration ran longer than expected. This was an availability incident for the downstream businesses as well as a confidentiality one. Dutch trade reporting adds that CEVA isolated and took the affected systems offline, opened an external investigation and informed regulators (ICTMagazine.nl, 2026-08-10).

Two things are conspicuously absent and should stay that way in any internal write-up. No source identifies how CEVA's order-processing systems were reached — no vulnerability, no phishing, no credential theft, no malware family, no actor or extortion brand. And the provenance of data already circulating is disputed: Dutch reporting records that data taken from CEVA is being offered for sale on a criminal forum, while CEVA maintains that dataset is old data from an earlier 2025 breach (ICTMagazine.nl, 2026-08-10). Treating the material on offer as this incident's proceeds is therefore not supported, and neither is the converse — no independent party has adjudicated the dispute.

Defender takeaway

the transferable lesson is about notification latency and inventory, not about CEVA. Every downstream organisation here learned about its own reportable breach from a supplier, and the intervals were uneven — bol was told on 1 August, Valve found out on 7 August, six days later, and had to notify its own customers from a standing start. For a public-sector or critical-infrastructure body, the equivalent exposure is any shared processor handling personal data at arm's length: parcel and mail fulfilment, hardware provisioning and asset dispatch, print and mailing houses, back-office order processing. Two questions decide how well such an incident goes. Does the processor inventory record which categories of personal data, for which populations, sit with each provider — because that is what a notification decision needs on day one and what none of these organisations could answer without asking their supplier. And does the contract oblige notification to the controller within a defined, short window rather than "without undue delay", because the gap between the first and last party learning of this one was measured in days while the regulatory clock ran for all of them. Note also that early customer-facing notices from affected retailers warned about a security incident at an external logistics partner rather than naming CEVA (ICTMagazine.nl, 2026-08-10), so an organisation that monitors for supplier incidents by watching for its suppliers' names in the press would not reliably have caught this one from the downstream disclosures.

The incident involves two systems used for processing orders from one of bol's fulfilment centers. No bol systems were affected. However, data of customers whose orders were processed via this location may have been viewed or copied.

bol.com 2026-08-06

Mark Schenkel, a spokesperson for the Dutch data protection authority, told TechCrunch that the agency has received data breach reports from 10 organizations in relation to the incident.

such as if the company knows how much personal data was taken, or if Ceva has received any communication from the hackers, such as a ransom demand

TechCrunch 2026-08-10

ATT&CK mapping

1 technique mapped from the cited reporting · MITRE ATT&CK v19.2

Collection TA0009

T1005Data from Local System

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

overlap matrix · ATT&CK page ↗

Sources

bol.comprimary TechCrunchcorroborating ICTMagazine.nlcorroborating

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.

Assessment

NATOB1NATO Admiralty code

Source reliabilityB Usually reliable

Info credibility1 Confirmed

Verificationmulti-source

Confidencehigh

CEVA has issued no public statement of its own; the fullest account of its position is the statement it provided to TechCrunch. bol.com's notice is a first-party disclosure about its own customers' data only, and it is the only party confirmed to have filed with the Dutch authority — no source identifies which ten organisations filed. Dutch reporting records data taken from CEVA being offered for sale on a criminal forum, which CEVA disputes, attributing that dataset to an earlier 2025 breach; this entry reports the dispute and adopts neither position. No source states an initial-access vector, malware family or actor, so this entry maps no access technique.

Entities

CEVA Logistics European fulfilment-systems breach (August 2026)

ATT&CK techniques

T1005 Data from Local System

Tags · regions · sectors

data-breach supply-chain europefinanceretailtransporttechnology