The CEVA Logistics breach, and why your shop is writing to you

Between 29 July and 1 August 2026 somebody got inside the systems of CEVA Logistics, one of the largest contract logistics operators in the world. On 1 August the company told the corporate customers it works for that a cyber intrusion was affecting part of its European contract logistics business, and said no other CEVA systems globally were involved. Eight European warehouses were disrupted over that weekend, which is why the first thing many shoppers noticed was a delayed parcel rather than a security notice. Valve was told on 7 August that data had been taken and started writing to buyers of Steam hardware on 10 August; the Dutch retailers went out to their own customers over the same days. CEVA itself has published nothing publicly and did not answer reporters who asked, so everything known about the scope comes from the companies it ships for.

Most retailers do not own the building your order was packed in. Under a contract logistics arrangement the provider holds the stock, picks and packs the orders and hands them to a carrier, all under the retailer’s name, and the only data it needs is the paperwork of a delivery. That structure explains both the spread and the shape of this incident: a single intrusion touches customers of a marketplace, a department store, an eyewear brand, a football club, a bank and a games company at once, and none of those customers has any relationship with the company that was actually breached. It also means there is no CEVA account to log into, no page where you can type your name and see whether you are on the list, and no way to find out except from the business you bought from.

Across the notices published so far the same fields recur: full name, street address, postcode, city and country, phone number, the email address attached to the order, and what was ordered, sometimes with the price and the order or tracking number. Bol added that a few records may carry the message someone wrote on a gift card. What is absent from every notice is equally consistent: no passwords, no login credentials, no payment card numbers. That absence is the useful part of this story. Nobody can sign in as you with a packing list, so the resets and security checks that follow a normal account breach do not apply here. What they can do is speak to you as if they were the company you bought from, which needs no password at all.

A delivery lure works on anyone who is waiting for a parcel, and this file tells the sender exactly who is. Expect a text or an email about a problem with your delivery, a small customs or redelivery fee, an address that “could not be confirmed”, or a refund for an order that really did go wrong. It will quote the item you bought, the price you paid and the address it went to, because whoever holds the data can read all three. That accuracy is the trap: most people check whether a message knows them rather than how it reached them. Treat the details as public from now on, and judge every message by the route instead. Open the retailer’s app or type its address yourself, and look at the order there. Real problems with a real order are always visible in your own account.

Four things, in order. Check the orders you are waiting for from inside the retailer’s own site or app rather than through any link. Turn on two-factor authentication for the mailbox tied to those orders, since the email address is now circulating next to your name, phone number and home address. Ask the retailer, in writing, what of yours was in the file and whether it has reported the incident to its data protection authority. And keep a note of the date the notice arrived, because a claim or a complaint made months later works better with a paper trail. Nothing on this list needs a password change, which is the unusual part of a breach like this one.

A leaked address is not undone by a notification. The same name, phone number and street address that came out of this warehouse are already published by people-search and data-broker sites, which is where the next round of target lists gets built regardless of who is breached next. Getting those listings taken down is the only step here with an effect that lasts past this news cycle, and it needs re-checking rather than doing once, because brokers re-list from public records within weeks. If you want the shorter version of the response to any breach, our post-breach guide covers it in seven steps, and the notification-letter guide explains how to read what a company sends you.