A Data Breach At Shipping Giant Ceva Logistics Is Rippling Across Banks, Retailers, Steam Gamers, and Beyond (techcrunch.com) 20
An anonymous reader quotes a report from TechCrunch: Ceva Logistics, one of the world's largest shipping and logistics giants, has been hacked. Several companies that rely on Ceva for shipping their products to their customers say that their personal information was also stolen in the breach. The cyberattack on Ceva is affecting at least eight warehouses across Europe used for shipping goods across the continent, the company told TechCrunch. Industry news site FreightWaves reports that the hack began on July 29 and is causing shipping delays for many of the goods in affected warehouses.
Ceva is a France-headquartered shipping and logistics giant that companies around the world rely on to deliver their goods from their assembly lines to customer homes. The company, which brought in $18.3 billion in revenue in 2025, has over a thousand warehouses across the world. [...] The hack at Ceva also resulted in a data breach, affecting a large amount of personal information belonging to retail customers that Ceva relies on for delivering goods to people's home addresses. Several companies reported that hackers took their customers' names, home addresses, phone numbers, and email addresses used to place their orders from Ceva's systems.
Dutch online retail giant Bol said on its website that hackers gained access to systems of its warehousing partner, Ceva, and warned that their customers' data may have been taken. Bol also said that it expects delays and some customer orders to be canceled as a result of the incident. De Bijenkorf, another Dutch luxury retailer, similarly confirmed order delays following the theft of its customers' data, per local media. Football club Ajax, banking giant ING, and eyeglass maker Ace & Tate also reported that customers' shipping information was affected. Video game giant Valve told customers that it learned on August 7 that data was taken from Ceva's systems, and alerted customers who recently bought its Steam hardware that they had personal information taken in the incident. Valve said in its note to customers, posted to Reddit, that Ceva stores their shipping and delivery information for 90 days following their order. So far, Ceva says the agency has received data breach reports from 10 organizations in relation to the incident.
Ceva is a France-headquartered shipping and logistics giant that companies around the world rely on to deliver their goods from their assembly lines to customer homes. The company, which brought in $18.3 billion in revenue in 2025, has over a thousand warehouses across the world. [...] The hack at Ceva also resulted in a data breach, affecting a large amount of personal information belonging to retail customers that Ceva relies on for delivering goods to people's home addresses. Several companies reported that hackers took their customers' names, home addresses, phone numbers, and email addresses used to place their orders from Ceva's systems.
Dutch online retail giant Bol said on its website that hackers gained access to systems of its warehousing partner, Ceva, and warned that their customers' data may have been taken. Bol also said that it expects delays and some customer orders to be canceled as a result of the incident. De Bijenkorf, another Dutch luxury retailer, similarly confirmed order delays following the theft of its customers' data, per local media. Football club Ajax, banking giant ING, and eyeglass maker Ace & Tate also reported that customers' shipping information was affected. Video game giant Valve told customers that it learned on August 7 that data was taken from Ceva's systems, and alerted customers who recently bought its Steam hardware that they had personal information taken in the incident. Valve said in its note to customers, posted to Reddit, that Ceva stores their shipping and delivery information for 90 days following their order. So far, Ceva says the agency has received data breach reports from 10 organizations in relation to the incident.
ChatGPT, everything is permitted (Score:4, Funny)
Can you please figure out a way to pay for yourself?
Why was all that in one database? (Score:3, Insightful)
No business role needs all that info. Why was all of that in one place to steal?
Huh? (Score:3)
No business role needs all that info. Why was all of that in one place to steal?
Perhaps I'm missing something? Name, address, phone number, and email address doesn't sound like a lot of information to store in a single database. Frankly it's just the customer table in many much larger databases that I've seen.
Every internet order I've placed required that information for the order.
Re: Huh? (Score:2)
But do you need those data items for every single client all at once? Why not (weak example to make point) one login for customers A through M and another for N through Z? If someone breaks security for a system, they should not ever be staring at a database of *everything*. Maybe divide customers by region? Or class of freight? It is insane to me that any user's login carries the ability to see all the data downloaded in this attack.
Re: Huh? (Score:4, Informative)
They're a logistics company. They take in products that are to be shipped to people. Likely they come in as the orders happen. So it's likely just a simple FIFO queue - someone from Steam buys a Steam Controller and their details get entered into the shipping database in FIFO order. As people work to package and ship product, that order will come up and whoever's the lucky person takes a steam controller, puts it in a box and slaps a label on it, then enters in the tracking information and tosses it on the shipping pile.
It's likely not ordered by anything - other than maybe the order the orders came in as. If someone else orders a widget after the guy orders a steam controller, the next person then gets to pick the widget, pack it into a box and then move on.
The database in question only contains orders up to 100 days old, so it's likely just the active database containing the orders that need to be sent out and orders that were sent out. Anyone fulfilling orders will need access to it so they can see what product needs to be packed and where to send it off to.
It's not a database of "every single client". It's a database of orders that have been shipped out and less than 100 days old and orders yet to shipped out because either they are being held for supply, or they just haven't gotten around to handling the order yet.
The 100 day history is so if there is a problem, it can be traced - if a product doesn't arrive, they can look at the order and figure out tracking. Or if there's a problem and it needs to be returned, it can be traced to the original shipment for RMA.
As far as it looks, other databases weren't compromised, which can include inventory information - what stock is on hand and where it is in the warehouse, or their customer information (as in who buys their services). The only thing compromised was the active order table which likely has lots of access out of necessity as people fulfilling orders need to read the database to get the orders, and backend systems like Valve need the ability to read, add and delete order entries to see what order status is, the ability to add an order, and the ability to cancel a shipment that hasn't gone out yet.
It looks like a perfectly reasonable way to segregate the business. They aren't storing your name, address, phone and email, it's just information that's needed to fulfill the order and any post-shipping issues that might arise. And it looks like that database was compromised
Re: (Score:1)
Maybe this info needs to be stored in some kind of encrypted escrow format. The database, instead of having an address, would have a blob that decrypts to the address in the shipper's system. And maybe not the full address, but only just enough information for routing - when the shipper picks it up, if its local they get the full address, if its across the country they just get enough to get the nearest distribution center, which has a key to decrypt the recipient's distribution center, and so on. at each s
Re: (Score:2)
Rather than mess with their shipping procedures (which they won't want to do), some sort of rate limiting on database access would prevent any user from dumping the database and exfiltrating it, without causing any noticeable delay.
Re: (Score:2)
Re: Why was all that in one database? (Score:2)
What person needs all the addresses *at once*? Why is there not separation by class of freight or by region? Why isn't there some requirement to query multiple databases that would set off alarms that someone is touching so many parts?
Re: (Score:2)
What person needs all the addresses *at once*? Why is there not separation by class of freight or by region? Why isn't there some requirement to query multiple databases that would set off alarms that someone is touching so many parts?
Person? No one. Businesses, every one. You need to store data to meet regulatory requirements. You need to store data to meet proof of service requirements. You need to store data to meet customs requirements. And TFS says 90 days so it very much sounds like they were storing the information for the limited amount of time possible.
Why is there not separation by class of freight or by region?
Thought experiment: You order something from Germany. The logistics company is responsible for picking it up in Germany, Road transfer to the Port of Rotterdam in the Netherlands,
Banks, Retailers, Steam Gamers (Score:3)
One of these things is not like the other
One of these things just doesn't belong
Can you tell me which thing is not like the other
Before I finish this song?
Get Your Priorities In Order. (Score:2)
Think of all the gamers waiting anxiously for their Steam box to arrive. The horror.
Re: (Score:2)
Take care with assumptions.
Re: (Score:2)
”Banks” struggling to stay solvent in a competitive market might choose to glob themselves onto any headline story about consumer crime in order to try and parlay their failures into something other than their own internal greed.
We already know how desperate “Retailers” are, slinging marketing strategies that would make seasoned OF creators blush.
Re: (Score:2)
No I can't.
If I order a product through Steam like Steamdeck, a logistics company is involved.
If I order a product through a retailer like a printed out picture of the facepalm meme, a logistics company is involved.
If I order a product through a bank like a frying pan set (https://www.ing.nl/punten/productdetail/1020520) a logistics company is involved.
Oh you thought the bank only runs a website didn't you? Don't assume so much, you make an ass of u.
Re: (Score:2)