What Happened at Ceva Logistics?
One of the world’s largest logistics companies has been hit by a data breach that’s sending ripples through its European client base. Ceva Logistics, a subsidiary of the French shipping giant CMA CGM Group, confirmed that its contract logistics operations in Europe were targeted.
The company, which handles warehousing, fulfilment, and aftermarket services for a range of big-name clients, said it notified affected customers on August 1. In a statement seen by Infosecurity, Ceva revealed that eight warehouses were impacted. The firm was quick to add that “no other Ceva systems globally were affected, and all other operations continue without incident.”
But the silence around the specifics has left many customers guessing about the scale of the exposure.
Valve and Steam Customers Caught in the Crossfire
One of the most high-profile casualties is Valve, the video game developer behind the Steam platform. In an email to its customers, Valve explained that the cyber-attack ran from July 29 to August 1. During that window, attackers may have accessed delivery-related information that Ceva holds for Steam’s physical hardware shipments in Europe.
“Ceva receives specific delivery-related information from Steam to be able to ship physical hardware to customers in Europe, and told us these are the details the attacker likely took,” Valve wrote. “Because Ceva retains this information for up to 90 days after that order, we are sending this message to all customers we can assume were impacted.”
The data potentially exposed includes names, email and home addresses, phone numbers, and order details. That’s a goldmine for cybercriminals, even if it doesn’t include financial information.
Who Else Is Affected?
Valve isn’t alone. Dutch online retailer Bol has publicly acknowledged the disruption, saying that restoration of operations at Ceva’s Veerweg location is taking longer than expected and could affect service levels. Other impacted clients include department store chain De Bijenkorf, football club Ajax, and banking giant ING.
The breadth of the victim list shows just how interconnected the logistics sector is. A single breach at a third-party provider can cascade through dozens of companies and thousands of consumers.
Why Logistics Companies Are Prime Targets
Joseph Perry, cybersecurity researcher and advanced services lead at Arcova, argues that logistics firms are an obvious choice for cybercriminals. “They sit at the center of thousands of transactions between businesses and their customers,” he said. “That makes them an appealing target because a compromise can create operational problems while also giving attackers access to information about the people and products moving through the system.”
Perry also stressed that shipping data is highly contextual. “A name, address, phone number, email address, and recent purchase can give attackers enough context to make phishing and impersonation attempts far more convincing.”
His advice? Treat logistics companies as “part of the security and operational environment” of everything that depends on them. “You do not have to be the final target to become the point of failure,” he added.
The Phishing Wave You Should Expect
Anna Collard, CISO advisor at KnowBe4, described the incident as a “textbook supply chain breach.” And she’s already predicting the fallout.
“I’d expect a wave of ‘delivery problem’ lures over the coming weeks, messages about a redelivery fee or a request to ‘verify’ an order,” Collard warned. “So treat any unexpected message about this order as fake, don’t click links or pay fees, and go directly to the retailer’s official site by typing the address yourself.”
That’s practical advice. If you’ve recently ordered physical hardware from Steam or made a purchase from Bol or De Bijenkorf, be extra cautious about any unsolicited messages referencing a delivery. Real companies rarely ask for payment via text or email.
A History of Attacks on CMA CGM
This isn’t the first time CMA CGM has faced a cybersecurity crisis. In 2020, the shipping giant suffered a ransomware attack on its servers, forcing the temporary closure of its shipping website and applications. That incident disrupted operations for days and highlighted the vulnerability of the maritime logistics sector.
The recurrence raises questions about whether enough has been done to harden the group’s defenses since then. While Ceva insists the latest breach is contained, the fact that customer data was stolen suggests gaps remain.
For businesses that rely on logistics partners, the lesson is clear: you’re only as secure as your weakest link. Regular security assessments of third-party vendors aren’t optional anymore. They’re essential. And for consumers, the takeaway is simpler: verify before you click.
