The Warehouse Nobody Watches: How One Logistics Breach Reached Steam Customers Across Europe- 319

August 13, 2026

When a global freight company gets breached, the damage rarely shows up on the freight company's own balance sheet first. Ceva Logistics, a France-headquartered operator running more than 1,700 facilities in over 170 countries as part of the CMA CGM Group, suffered a cyberattack on July 29 that disrupted eight of its European warehouses — and the visible consequences of that intrusion surfaced not through Ceva's own disclosures, which have been minimal, but through a cascade of notifications from the retailers and platforms that depend on Ceva to move their goods. Dutch e-commerce giant Bol, luxury department store De Bijenkorf, eyewear retailer Ace & Tate, Amsterdam football club Ajax, and Valve's European Steam hardware business all told customers in the days that followed that their data may have been exposed — not because any of them were breached directly, but because all of them had trusted Ceva with parts of their fulfillment operations.

The disruption itself was concrete and immediate: goods stored at the affected warehouses could not be shipped, orders were delayed or canceled, and Ceva notified corporate clients on August 1 that part of its contract logistics business had been compromised. Bol's investigation found that attackers had gained access to two specific Ceva systems used to process orders from one of its distribution centers — systems that reportedly held names, addresses, postal codes, phone numbers, email addresses, order numbers, tracking information, purchase details, and in some cases messages attached to gift cards. De Bijenkorf's own notice to customers described a similar exposure — names, contact details, and online order information, including product, pricing, and delivery data, plus company names and VAT numbers for business accounts — while stating plainly that no financial data was involved. Valve's notification to European Steam hardware customers followed the same shape: because Ceva handles European shipments and can retain customer delivery records for up to 90 days after an order, potentially compromised information included names, addresses, phone numbers, email addresses, and the type and price of hardware ordered — though Valve was explicit that payment details, passwords, and Steam Guard codes were never exposed, since Ceva never had access to them in the first place. Notably, a source described to FreightWaves as familiar with the investigation said Ceva's own air, ocean, ground, and rail transportation management operations continued without disruption — the damage stayed contained to the contract-logistics systems handling these specific warehouse operations, rather than spreading across the company's broader freight network.

What makes this case worth more than a passing mention is what happened months after the initial, relatively muted disclosures: in November, a hacker reportedly offered Ceva's database for sale on a dark web marketplace, claiming it contained customer lists, shipping records, contracts, pricing information, and banking details — a claim considerably broader than anything Ceva, Bol, or De Bijenkorf had described in their original customer notifications. Whether that listing represents the same July intrusion resurfacing for monetization, a separate compromise entirely, or an exaggerated resale of recycled material is not something any of the public reporting resolves — but the pattern should be familiar by now: data that a company describes as possibly, cautiously exposed at the time of disclosure has a way of reappearing later, offered for sale with claims of a scope the original notice never confirmed. No ransomware group has claimed responsibility for the original attack, and Ceva has not said whether a ransom was demanded at all, leaving open the possibility that this was a pure data-theft operation from the outset rather than an encryption-and-extortion play that simply never became public.

The structural lesson sits less with Ceva specifically than with what Ceva represents: a single contract-logistics vendor sitting quietly behind the storefronts of a department store, an eyewear brand, a football club's merchandise operation, and one of the world's largest video game platforms, none of which had any reason to audit each other's security posture because none of them chose each other — they each chose Ceva, and inherited whatever happened to Ceva's own systems as a consequence. A customer buying eyewear from Ace & Tate or hardware from Steam has no practical way to know, and no obvious reason to ask, which third-party logistics provider is actually handling their delivery data behind the scenes. That invisibility is precisely the position Ceva occupied for years without incident, and precisely why the eventual breach reached five very different consumer brands across Europe simultaneously, through a single point of failure none of their own customers ever had the opportunity to evaluate.