The July 2026 Ceva Logistics Cyberattack: What Happened, Who Was Affected, and What Was Stolen

A single cyberattack on a global logistics giant turned into a cascading data breach that touched retail giants, a major bank, a football club, and thousands of Steam gamers across Europe. Here is a clear, source-backed breakdown of what happened in the July 2026 Ceva Logistics incident.

The Attack: July 29 – August 1, 2026

On July 29, 2026, an unidentified attacker gained unauthorized access to order-processing systems at Ceva Logistics, a France-headquartered freight and contract logistics company owned by the CMA CGM Group . The intruder maintained access until August 1, affecting Ceva's European contract logistics operations — specifically, eight warehouses across the continent .

Ceva notified its affected clients on August 1 that a "cyber intrusion" had disrupted operations at those sites, halting outgoing shipments .

Which Companies and Customers Were Affected?

None of the brands involved suffered a direct breach. Instead, all of them shared Ceva as a third-party fulfillment partner, making this a textbook supply-chain (or fourth-party) data incident. The Dutch data protection authority (Autoriteit Persoonsgegevens) received GDPR Article 33 breach reports from at least ten separate organizations . The confirmed list includes:

• Bol (the largest Dutch online retailer) — warned customers on August 5–6 that names, addresses, and phone numbers may have been exposed . Bol suspended data sharing with Ceva after the incident .
• De Bijenkorf (Dutch luxury department store) — sent similar warnings on August 5 .
• Ajax (Amsterdam football club) — confirmed on August 6 that its online shop handled by Ceva may have exposed customer data .
• ING (Dutch multinational bank) — reported a "cyber incident at a logistics partner," affecting customers who redeemed loyalty points for physical goods shipped by Ceva .
• Ace & Tate (eyewear retailer) — notified customers that parcel-related personal data may have been accessed .
• Valve / Steam hardware customers — Valve sent breach notifications starting August 7 to European customers who ordered a Steam Deck, Steam Controller, or Steam Machine, and whose data was still held by Ceva (typically orders within the previous 90 days) .

What Types of Personal Data Were Stolen?

The attackers obtained delivery and order data that Ceva held to fulfill shipments. The exposed fields consistently reported across multiple news outlets include :

• Full names
• Physical addresses (home and shipping)
• Phone numbers
• Email addresses
• Order details (product type, order number, price)

Multiple sources from TechCrunch, Bleeping Computer, and The Register confirm that financial data — including credit card numbers, bank account details, and login credentials — was not compromised, because Ceva never stored it . However, the exposure of contact and order data creates a heightened risk of targeted phishing and social engineering attacks, a point Valve explicitly warned its customers about .

Operational Impact: Eight Warehouses Disrupted

The cyberattack had a tangible physical impact. Ceva confirmed that shipments were halted or significantly delayed at the eight affected European warehouses . Ceva stated that no other systems globally were affected and that all other operations continued without interruption . As of mid-August 2026, the company was still working to restore full operations at the impacted sites . Some shipments were canceled, and delivery timelines remained uncertain .

Ceva's Official Response

Ceva Logistics provided a limited public statement, which it shared with multiple news outlets. The company said :

"The operational impact is limited to eight warehouses. No other CEVA systems globally were affected, and all other operations continue without interruption."

Ceva also stated it could not rule out that personal data had been exposed and that the investigation was ongoing . The company declined to disclose technical details about the intrusion, and as of publication, no ransomware group had claimed responsibility .

Investigating Authorities

• Dutch Data Protection Authority (Autoriteit Persoonsgegevens) — received Article 33 breach notifications from at least ten organizations, including all the affected companies listed above .
• National law enforcement — the breach is under investigation by Dutch police and other cybercrime units, though they have not issued public statements .
• Internal forensics — Ceva and each affected company are conducting their own forensic investigations .

Key Takeaways for Affected Customers

• Your financial accounts and passwords are safe — no payment data or login credentials were taken.
• Be alert for phishing attempts: Scammers may use your real name, address, and order history to appear legitimate. Valve explicitly warned customers that attackers may "quote your address back to you" and ask for a payment or login — treat all such requests as fake .
• If you ordered from Bol, De Bijenkorf, ING's rewards shop, Ajax's online store, Ace & Tate, or Steam hardware in Europe between roughly May and August 2026, your delivery contact details may have been exposed.

The Ceva breach is a stark reminder that a single vendor compromise can ripple across an entire ecosystem of trusted brands, turning a logistics failure into a widespread data exposure event.