A cyberattack at CEVA Logistics is now surfacing in customer notices across Europe.
CEVA said the intrusion affected part of its European contract-logistics operation, including eight warehouses. Several clients have since notified customers that information held by CEVA may have been accessed.
Client notices are beginning to clarify which organizations and data types were affected.
Names, addresses, and purchase details were among exposed records
More organizations may still be dealing with the fallout. A spokesperson for the Dutch Data Protection Authority told TechCrunch that the agency had received breach reports from 10 organizations connected to the incident.
Bol said unauthorized individuals gained access to systems and data belonging to its logistics partner. Customer information tied to orders processed at one fulfillment center may have been viewed or copied, while Bol’s own systems were not affected. Similar incidents can expose customer information through a third-party provider without attackers entering the client’s environment.
De Bijenkorf disclosed possible exposure of customer contact information and online-order data through an external logistics partner. Its incident notice says payment information, bank account numbers, usernames, and passwords were not involved.
Stolen delivery details can make phishing more convincing
Real order and delivery context can help scammers write messages that fit a victim’s recent activity. A reference to a genuine purchase or expected shipment can make a fake customs or redelivery request look credible, similar to smishing campaigns that impersonate delivery brands.
Steam hardware customers in Europe received one of the more specific warnings. Valve said its shipping partner retains delivery information for up to 90 days and warned customers to expect fraudulent email, text or phone messages referencing their orders. Valve’s notice said the provider did not have access to payment information, passwords, or Steam Guard codes.
Security teams should reduce vendor data exposure
If your organization shares customer records with a logistics or fulfillment provider, include those records in your security oversight even after they leave your systems. Knowing what each provider receives and how long it retains customer information can help limit exposure when a vendor is breached.
Security teams can tighten that exposure by focusing on a few controls:
- Limit vendor access: Share only the customer information a provider needs to perform its service, and review access when the relationship or service changes.
- Set retention limits: Require providers to delete customer and delivery records once there is no longer a business need to keep them.
- Plan for vendor breaches: Establish notification timelines and response responsibilities before an incident so teams can quickly identify affected customers and exposed information. Regular third-party risk management should include these requirements.
Anyone receiving a CEVA-related notification should be cautious with unexpected shipping or payment messages, even when they contain a real address or order detail. Open the company’s official website or app yourself instead of following an unsolicited link, and verify unexpected charges before paying. Password resets are unnecessary solely because of this incident unless an affected company reports credential exposure or recommends one.
Ordinary shipping records can give attackers enough personal context to create convincing social-engineering attempts. Reducing what outside providers receive and how long they retain it gives attackers less customer information to work with after a vendor compromise.
Read more: A breach at Levi Strauss began with social engineering aimed at just three employees, showing how few compromised accounts can open the door to corporate data.