On July 29, 2026, Ceva Logistics' European contract logistics operations were disrupted by a cyberattack affecting eight warehouses. The incident impacted two order processing systems at a Bol fulfillment center, leading to shipment delays and potential data exposure. Affected data includes customer names, addresses, emails, phone numbers, online order details, and business entity information, but excludes payment details and credentials. Multiple organizations confirmed impact, including Bol, De Bijenkorf, ING, Ace & Tate, Ajax football club, and Valve. The attack vector, scope of data compromised, and responsible actors have not been disclosed. Ceva Logistics, a subsidiary of CMA CGM Group, is actively restoring affected services. This is not the first breach involving Ceva, with prior attacks claimed by extortion groups in the previous year.

The cyberattack caused operational disruption at eight European warehouses, resulting in shipment delays for multiple customers. Personal and business data related to order processing was potentially exposed, including names, addresses, emails, phone numbers, and order details. No payment or credential information was compromised. The incident affected several organizations relying on Ceva for logistics, potentially impacting their customers' privacy and causing reputational and operational harm. The full extent of the breach and number of individuals affected remain unclear.

No specific remediation or patch information is available. Ceva Logistics is actively working to restore impacted services and has notified affected customers. Organizations using Ceva's services should follow any guidance provided by Ceva and monitor communications for updates. Patch status is not yet confirmed — check the vendor advisory or official communications from Ceva Logistics for current remediation guidance.