A data breach at shipping giant Ceva Logistics is rippling across banks, retailers, Steam gamers, and beyond

Ceva Logistics, 1 of the world’s largest shipping and logistics giants, has been hacked. Several companies that trust connected Ceva for shipping their products to their customers accidental that their idiosyncratic accusation was besides stolen successful the breach.

The cyberattack connected Ceva is affecting astatine slightest 8 warehouses crossed Europe utilized for shipping goods crossed the continent, the institution told TechCrunch.

Industry quality tract FreightWaves reports that the hack began connected July 29 and is causing shipping delays for galore of the goods successful affected warehouses.

Ceva is simply a France-headquartered shipping and logistics elephantine that companies astir the satellite trust connected to present their goods from their assembly lines to lawsuit homes. The company, which brought successful $18.3 cardinal successful gross successful 2025, has implicit a 1000 warehouses crossed the world.

Shipping and logistics giants person go a increasing people for cybercriminals in caller years for their quality to entree and hijack trucks and containers afloat of goods into the hands of real-world gangs.

The hack astatine Ceva besides resulted successful a information breach, affecting a ample magnitude of idiosyncratic accusation belonging to retail customers that Ceva relies connected for delivering goods to people’s location addresses. Several companies reported that hackers took their customers’ names, location addresses, telephone numbers, and email addresses utilized to spot their orders from Ceva’s systems.

Dutch online retail elephantine Bol said on its website that hackers gained entree to systems of its warehousing partner, Ceva, and warned that their customers’ information whitethorn person been taken. Bol also said that it expects delays and immoderate lawsuit orders to beryllium cancelled arsenic a effect of the incident.

De Bijenkorf, different Dutch luxury retailer, similarly confirmed bid delays pursuing the theft of its customers’ data, per local media. Football nine Ajax, banking elephantine ING, and eyeglass shaper Ace & Tate also reported that customers’ shipping accusation was affected. 

Video crippled elephantine Valve told customers that it learned connected August 7 that information was taken from Ceva’s systems, and alerted customers who precocious bought its Steam hardware that they had idiosyncratic accusation taken successful the incident. Valve said successful its enactment to customers, posted to Reddit, that Ceva stores their shipping and transportation accusation for 90 days pursuing their order.

Valve spokesperson Doug Lombardi did not respond to a petition for remark astir the incident. 

Ceva confirmed successful a connection to TechCrunch that it was experiencing a cyberattack.

“On Aug. 1, CEVA Logistics confirmed to affected customers that a cyber intrusion was impacting portion of its European declaration logistics operations. As soon arsenic the incidental was identified, CEVA’s cybersecurity teams instantly activated its information protocols and launched a thorough investigation, which is inactive ongoing,” per the connection provided to TechCrunch. “The operational interaction is constricted to 8 warehouses. No different CEVA systems globally were affected, and each different operations proceed without incident.”

Ceva spokesperson Ryan Fisher would not reply TechCrunch’s questions astir the incident, specified arsenic if the institution knows however overmuch idiosyncratic information was taken, oregon if Ceva has received immoderate connection from the hackers, specified arsenic a ransom demand.

Ceva said immoderate of its affected applications and services are backmost online, and that it was moving with the authorities. Ceva’s website was not decently loading astatine the clip of work connected Monday.

Authorities successful the Netherlands are said to beryllium investigating the incident. 

Mark Schenkel, a spokesperson for the Dutch information extortion authority, did not respond to TechCrunch’s petition for remark connected Monday astir the incident.