One shipping vendor, a dozen household names
A single intrusion at a contract-logistics company has turned into a data exposure problem for a bank, a video game platform, a football club and several retailers across the Netherlands and Belgium. The common thread is not that any of those organizations were hacked directly. It is that they all shipped orders through the same vendor: CEVA Logistics, a global freight and contract-logistics firm.
According to CEVA and reporting from TechCrunch and The Record, attackers had access to CEVA's systems for roughly four days, from around July 29 to August 1, 2026. The company says the intrusion was narrow in technical terms: two systems used for order processing at one distribution center run for the Dutch e-commerce platform Bol, plus a total of eight European warehouses. CEVA maintains that nothing outside those eight sites was touched, and that the incident is confined to its European contract-logistics business.
Narrow in scope did not mean narrow in effect. Contract logistics is by design plumbing that sits underneath other companies' customer relationships, so a breach two layers removed from a shopper still lands squarely on that shopper's inbox.
What actually leaked
The exposed data, per CEVA and Valve's own disclosures, covers customer names, home and postal addresses, phone numbers, email addresses, order numbers, and tracking or purchase details. In some cases it included the personal messages attached to gift orders. It did not include payment card numbers, account passwords, or Steam Guard authentication codes, because CEVA's systems never held that data in the first place - only the shipping and order metadata needed to get a package to a door.
That distinction matters for anyone deciding how worried to be. This is a contact-and-order-history exposure, not a financial or account-takeover one. The practical risk it creates is phishing: someone with a real name, address and order number can write a convincing fake delivery message.
How wide the fallout runs
Valve, which sells Steam hardware such as the Steam Deck and Steam Machine, says it learned of the breach on August 7 and began notifying affected European customers on August 10. Valve told customers that CEVA holds order data for up to 90 days after a purchase, which is what determined the window of Steam customers now being contacted. The company has warned those customers to watch for phishing that leverages the leaked delivery details, and has been explicit that legitimate Valve communications never ask a customer to confirm a password or pay a delivery fee.
Beyond Valve, the confirmed list of affected organizations includes Bol itself, the department store De Bijenkorf, the Amsterdam football club Ajax, eyewear retailer Ace & Tate, and the banking group ING. Zalando has also been named as a CEVA customer in the reporting, though its own exposure has not been detailed to the same degree as the others. TechCrunch reports that roughly ten organizations tied to this incident have filed breach notifications with the Dutch data protection authority, which gives a rough sense of how many separate customer bases are now dealing with the fallout from one vendor's systems.
What's still unconfirmed
No group has publicly claimed the intrusion, and it remains unclear whether ransomware was involved or whether CEVA received an extortion demand. CEVA has not answered questions on that point; a company spokesperson has confirmed only that its cybersecurity team activated incident-response protocols and that an investigation is ongoing. No CVE identifier or technical description of how the attackers got in has been published, so the entry point - whether stolen credentials, a phishing lure against CEVA staff, or a software vulnerability - is not yet public.
What it means in practice
If you have ordered from Bol, De Bijenkorf, Ace & Tate, or bought Steam hardware and shipped it to a European address in the past few months, treat any delivery-related message you did not initiate with suspicion, especially one asking you to confirm a password, pay a redelivery fee, or click a tracking link from an unfamiliar sender. Go directly to the retailer's own site or app to check an order rather than following a link in an email or text.
For businesses, the episode is a reminder that a security review of a shipping or logistics partner is not a box-ticking exercise. The companies named here did not fail to protect their own networks; their customer data left through a vendor most of their customers have never heard of. That is precisely the kind of exposure that a company's own perimeter defenses cannot catch, because it never crosses that perimeter at all.
