# CEVA Logistics Breach Spills Customer Data Into Steam, ING and Ajax

Page: https://hirantha.me/blog/ceva-logistics-breach-spills-customer-data-into-steam-ing-and-ajax
Published: 2026-08-13
Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom
Topics: data breach, ceva logistics, supply chain security, steam, third-party risk

> A breach at shipping firm CEVA Logistics exposed customer data that reached Steam, ING, Ajax and other European clients.

## One shipping vendor, a dozen household names

A single intrusion at a contract-logistics company has turned into a data exposure problem for a bank, a video game platform, a football club and several retailers across the Netherlands and Belgium. The common thread is not that any of those organizations were hacked directly. It is that they all shipped orders through the same vendor: CEVA Logistics, a global freight and contract-logistics firm.

According to CEVA and reporting from TechCrunch and The Record, attackers had access to CEVA's systems for roughly four days, from around July 29 to August 1, 2026. The company says the intrusion was narrow in technical terms: two systems used for order processing at one distribution center run for the Dutch e-commerce platform Bol, plus a total of eight European warehouses. CEVA maintains that nothing outside those eight sites was touched, and that the incident is confined to its European contract-logistics business.

Narrow in scope did not mean narrow in effect. Contract logistics is by design plumbing that sits underneath other companies' customer relationships, so a breach two layers removed from a shopper still lands squarely on that shopper's inbox.

## What actually leaked

The exposed data, per CEVA and Valve's own disclosures, covers customer names, home and postal addresses, phone numbers, email addresses, order numbers, and tracking or purchase details. In some cases it included the personal messages attached to gift orders. It did not include payment card numbers, account passwords, or Steam Guard authentication codes, because CEVA's systems never held that data in the first place - only the shipping and order metadata needed to get a package to a door.

That distinction matters for anyone deciding how worried to be. This is a contact-and-order-history exposure, not a financial or account-takeover one. The practical risk it creates is phishing: someone with a real name, address and order number can write a convincing fake delivery message.

## How wide the fallout runs

Valve, which sells Steam hardware such as the Steam Deck and Steam Machine, says it learned of the breach on August 7 and began notifying affected European customers on August 10. Valve told customers that CEVA holds order data for up to 90 days after a purchase, which is what determined the window of Steam customers now being contacted. The company has warned those customers to watch for phishing that leverages the leaked delivery details, and has been explicit that legitimate Valve communications never ask a customer to confirm a password or pay a delivery fee.

Beyond Valve, the confirmed list of affected organizations includes Bol itself, the department store De Bijenkorf, the Amsterdam football club Ajax, eyewear retailer Ace & Tate, and the banking group ING. Zalando has also been named as a CEVA customer in the reporting, though its own exposure has not been detailed to the same degree as the others. TechCrunch reports that roughly ten organizations tied to this incident have filed breach notifications with the Dutch data protection authority, which gives a rough sense of how many separate customer bases are now dealing with the fallout from one vendor's systems.

## What's still unconfirmed

No group has publicly claimed the intrusion, and it remains unclear whether ransomware was involved or whether CEVA received an extortion demand. CEVA has not answered questions on that point; a company spokesperson has confirmed only that its cybersecurity team activated incident-response protocols and that an investigation is ongoing. No CVE identifier or technical description of how the attackers got in has been published, so the entry point - whether stolen credentials, a phishing lure against CEVA staff, or a software vulnerability - is not yet public.

## What it means in practice

If you have ordered from Bol, De Bijenkorf, Ace & Tate, or bought Steam hardware and shipped it to a European address in the past few months, treat any delivery-related message you did not initiate with suspicion, especially one asking you to confirm a password, pay a redelivery fee, or click a tracking link from an unfamiliar sender. Go directly to the retailer's own site or app to check an order rather than following a link in an email or text.

For businesses, the episode is a reminder that a security review of a shipping or logistics partner is not a box-ticking exercise. The companies named here did not fail to protect their own networks; their customer data left through a vendor most of their customers have never heard of. That is precisely the kind of exposure that a company's own perimeter defenses cannot catch, because it never crosses that perimeter at all.

## Questions

**What happened in the CEVA Logistics breach?**
Attackers accessed two CEVA order-processing systems covering eight European warehouses for about four days in late July and early August 2026, exposing customer contact and order details for several of CEVA's clients.

**Was my payment information or password exposed?**
No. CEVA's systems held shipping and order metadata such as names, addresses and order numbers, not payment card data, account passwords, or Steam Guard codes.

**Which companies were affected?**
Confirmed affected organizations include Valve's Steam hardware customers, Bol, De Bijenkorf, Ajax, Ace & Tate and ING, with Zalando also named as a CEVA client in reporting.

**What should I do if I received a breach notification?**
Be cautious of any unsolicited delivery or account message, avoid clicking links in them, and go directly to the retailer's own site to verify order status; legitimate Valve messages never ask for a password or delivery fee.

**Who was behind the attack?**
No group has claimed responsibility, and CEVA has not confirmed whether ransomware or an extortion demand was involved; the investigation is still ongoing.

## Sources

- [A data breach at shipping giant Ceva Logistics is rippling across banks, retailers, Steam gamers, and beyond](https://techcrunch.com/2026/08/10/a-data-breach-at-shipping-giant-ceva-logistics-is-rippling-across-banks-retailers-steam-gamers-and-beyond/), TechCrunch
- [Cyberattack on logistics giant Ceva hits retailers and Steam customers across Europe](https://therecord.media/ceva-logistics-cyberattack-bol-steam-debijenkorf-ace-tate), The Record from Recorded Future News
- [Valve notifies Steam hardware customers of a data breach](https://www.bleepingcomputer.com/news/security/valve-notifies-steam-hardware-customers-of-a-data-breach/), BleepingComputer