Ceva Logistics, a major global logistics provider and a subsidiary of the French CMA CGM Group, has confirmed a data breach affecting its European contract logistics operations. The incident, which occurred between July 29 and August 1, impacted eight warehouses and led to the compromise of specific delivery-related information for European customers.
According to a statement from Ceva, which notified affected clients on August 1, the breach was limited to its European contract logistics systems. The company stated that no other Ceva systems globally were affected, and all other operations continued without interruption. This part of Ceva's business handles warehousing, fulfillment, manufacturing support, and aftermarket services for its clients.
Among the confirmed victims is video game developer Valve, which informed its customers that Ceva receives delivery information from Steam to ship physical hardware in Europe. Valve indicated that the attackers likely obtained names, email and home addresses, phone numbers, and order details, as Ceva retains this information for up to 90 days after an order. Other impacted clients include Dutch online retailer Bol, which noted that restoration of operations at Ceva’s Veerweg location was taking longer than expected, potentially affecting service levels. Dutch department store chain De Bijenkorf, football club Ajax, and banking giant ING were also affected.
This incident highlights the vulnerability of the logistics sector to cyberattacks. In 2020, Ceva's parent company, CMA CGM, experienced a ransomware attack that temporarily shut down its shipping website and applications. Experts suggest that logistics companies are attractive targets for cybercriminals due to their central role in numerous transactions, providing access to both operational control and sensitive customer data. Compromised shipping information, including names, addresses, phone numbers, emails, and recent purchases, can be used to craft highly convincing phishing and impersonation attempts. Organizations relying on logistics providers are advised to consider these partners as integral to their own security posture.
