A cyberattack on CEVA Logistics disrupted eight European warehouses and exposed or potentially exposed customer information belonging to organizations that relied on CEVA for fulfillment and shipping. Companies including Ajax, Ace & Tate, de Bijenkorf, ING, and Valve notified customers as the impact spread beyond CEVA itself.
The incident is a useful example of how third-party cyber risk actually feels in the real world. A customer buys glasses, football merchandise, a Steam device, or another product from a company they trust. Behind that transaction sits a logistics provider they may never have heard of, holding enough information to deliver the order. When that provider is breached, one cyber incident suddenly becomes several companies’ customer-trust problem.
CEVA Logistics confirmed that a cyber intrusion affected part of its European contract-logistics operation at the end of July 2026. The company told affected customers on August 1 and said the operational impact was limited to eight warehouses in Europe, while its other global operations continued normally.
The attack caused shipping delays and interrupted order processing for some retailers using those warehouses. FreightWaves reported that the incident affected warehouse operations beginning around July 29, while CEVA activated security protocols and began investigating with external specialists and authorities.
The data impact then began appearing through CEVA’s customers.
Ajax said CEVA handled orders from its online shop and warned customers that unauthorized individuals may have accessed CEVA systems and data. The football club said its own systems were not affected.
Eyewear retailer Ace & Tate said information potentially involved included names, email addresses, postal and billing addresses, phone numbers, delivery methods, tracking information, and details about products ordered and their prices. It said payment details, bank-account numbers, credit-card information, usernames, and passwords were not involved.
Dutch retailer de Bijenkorf similarly reported that order processing at its distribution center was temporarily stopped and that names, contact information, and online-order data might have been involved.
TechCrunch also reported notifications involving ING customers and European customers who had purchased Valve’s Steam hardware. Dutch authorities said they had received breach reports from 10 organizations connected to the incident.
That is quite a downstream footprint for one compromised logistics relationship.
Most customers have no idea how many organizations touch a transaction after they press “Buy.”
There may be payment providers, customer-service platforms, marketing systems, warehouses, logistics partners, couriers, returns processors, identity services, cloud providers, and other subcontractors sitting behind a familiar brand.
Each company receives some information because it has a job to do.
A logistics provider obviously needs a delivery address. It may also need a name, phone number, email address, tracking information, product details, and other information required to move a parcel from a warehouse to somebody’s front door.
That creates a dependency most customers never see.
For the business, CEVA is a supplier. For the customer, Ajax is Ajax, Steam is Steam, and the retailer they bought their glasses from is the company they expect to protect their information. When a vendor is breached, customers rarely experience the organizational chart showing who was technically responsible for which system. They experience the brand they gave their information to telling them it has gone somewhere it should not have.
That makes third-party cybersecurity a customer-trust issue as much as a procurement issue.
Our article on Vendor Dependency and the Human Side of Third-Party Risk looks at this broader problem. Vendor risk lives in everyday decisions about what gets shared, who can access it, what employees assume a supplier is authorized to do, and how quickly the organization can respond when that trust relationship changes.
The CEVA incident also creates a slightly awkward communications problem for affected brands.
Customers may receive a legitimate email warning them about a logistics provider they do not recognize. They are then expected to understand why that unfamiliar company had their home address and order details in the first place.
At exactly the same time, attackers may have information that helps them create more believable messages.
Order information is useful social-engineering material because it provides context. A message mentioning a recent product, delayed shipment, delivery problem, refund, or address confirmation feels much more plausible than a random phishing email.
Tracking information and phone numbers can add another layer. Someone expecting a delayed parcel is not likely to find a text about a delivery problem particularly unusual.
The right customer advice is therefore more useful than simply saying, “Be vigilant.” Customers should know what kinds of data were involved, what the company will and will not ask them to do, where legitimate order information can be checked, and how to report a suspicious communication.
Internally, support teams need the same clarity. If an affected customer receives an odd message about a shipment, the employee answering the phone should know whether it is legitimate, where to escalate it, and what guidance to provide.
That is one reason we talk about calibrated trust rather than telling everybody to distrust everything. Our article Trust Issues: Why Cyber Risk Now Starts With What People Believe explores how people decide whether vendors, messages, systems, and requests are legitimate enough to act on.
The CEVA breach is also a useful prompt for organizations to look at data minimization through an operational lens.
Ace & Tate’s notice provides a good example of the information a fulfillment partner may receive: names, addresses, phone numbers, email addresses, delivery and tracking details, and information about the products ordered.
None of that is surprising. The provider needs enough information to fulfill the service.
The more useful questions are how long the information needs to remain available, which systems need access to it, whether all fields are necessary, and what happens after the shipment has been completed.
Third-party risk assessments often concentrate heavily on whether the vendor has the right certifications, policies, controls, and contractual clauses. Those things matter. The operational relationship matters too.
What data are we actually giving them? Who inside our organization can expand that data flow? Who owns the relationship? How quickly can we stop sharing information if something happens? Can we identify which customers are affected? Do we know which other business processes depend on the same supplier?
Ace & Tate said it stopped sharing data with the affected logistics provider as soon as it learned about the incident. That is the kind of response capability organizations need to understand before a supplier is in crisis rather than discovering it during one.
Organizations should prepare customer-facing teams as quickly as they prepare technical teams. Support, communications, privacy, legal, procurement, security, and the business owner of the vendor relationship all need a consistent picture of what is known and what remains uncertain.
Customer communications should explain the role of the third party in plain language. If people are wondering, “Why did this company have my data?”, answer that question.
Organizations should also consider likely follow-on scams when developing breach guidance. If shipping information was affected, warn about fake delivery messages. If order details were exposed, explain that criminals may know what someone bought. If contact details were involved, remind customers that including accurate personal information does not make a message genuine.
Behind the scenes, companies should review whether the vendor still needs access to the same information, whether data-sharing can be temporarily restricted, and whether another provider or workaround is available if operations remain disrupted.
A vendor incident should also feed back into the wider Human Risk Management program. Procurement teams, vendor owners, customer support, finance, IT, privacy, and operational teams all make decisions around third parties. Those audiences need the competency and confidence to recognize when a vendor request, access pattern, or communication has moved outside normal boundaries.
Third-party risk is much easier to manage when it is somebody’s job before the breach.
The CEVA Logistics incident shows why supply-chain cyber risk extends well beyond software.
Organizations increasingly operate through ecosystems. Someone else stores the data, ships the product, processes the payment, runs the cloud platform, supports the customer, or provides the technology that keeps another part of the business moving.
Those relationships create efficiency, expertise, and scale. They also create inherited risk.
The human side appears wherever employees manage those dependencies: deciding what to share, approving access, responding to supplier requests, interpreting warning signs, communicating with customers, and working around disruption when a vendor suddenly becomes unavailable.
Culture matters too. Does somebody feel responsible for questioning a long-standing supplier? Can a team stop a data flow quickly without three weeks of internal archaeology? Will employees escalate an unusual vendor request, or does familiarity make it feel automatically safe?
A mature Human Risk Management program should be able to see those conditions alongside the more familiar risks of phishing, passwords, and training completion.
The vendor may sit outside the company. The trust relationship does not.
Cybermaniacs helps organizations understand and reduce the human factors that contribute to cyber risk across employees, leaders, contractors, vendors, and the wider operating environment.
Our continuous cybersecurity learning, managed phishing, policy training, campaigns, communications, champions programs, and role-based competency development help people practice safer decisions in the situations they actually encounter at work.
For organizations that need deeper visibility, our Human Risk Baseline examines the competency, behavioral, psychological, cultural, and organizational factors influencing workforce risk, helping teams understand why risk exists and where interventions should be targeted.
Cybermaniacs also provides HRM Advisory & Program Management support to help organizations build and mature Human Risk Management programs that connect learning, culture, threat exposure, measurement, governance, engagement, and operational resilience.
CEVA Logistics confirmed a cyber intrusion affecting part of its European contract-logistics operation in late July 2026. The incident affected eight warehouses, disrupted some customer shipments, and resulted in several CEVA customers reporting that personal information had been exposed or potentially exposed.
Public reporting and company notifications connected the incident to organizations including Ajax, Ace & Tate, de Bijenkorf, ING, and Valve, among others. Dutch authorities said they received breach notifications from 10 organizations linked to the incident.
The exact information varied by CEVA customer. Ace & Tate said potentially affected information included names, email addresses, postal and billing addresses, phone numbers, delivery and tracking information, and order details. It said payment information, bank details, usernames, and passwords were not involved.
Yes. CEVA said the operational impact was limited to eight European warehouses. Retailers reported delays, temporary changes to online ordering, and disruption to order processing while systems were secured and investigated.
Companies routinely share customer information with logistics providers so orders can be fulfilled. When a supplier is compromised, the original company may still have to notify customers, manage disruption, respond to follow-on scams, and protect trust in its own brand.
Potentially. Shipping details, product information, names, email addresses, phone numbers, and delivery information can make fraudulent delivery, refund, order, or account messages more convincing. Customers should verify unexpected requests through known websites or contact channels.
Organizations should define ownership of vendor relationships, minimize unnecessary data sharing, establish verification rules for sensitive vendor requests, prepare employees for supplier-related social engineering, monitor access, maintain escalation routes, and plan how customer-facing teams will respond if a vendor is breached.