Between 29 July and 1 August 2026, CEVA Logistics, a France-headquartered contract logistics operator running more than 1,000 warehouses worldwide, was attacked. Eight European warehouses were affected. Contract logistics operations paused at those sites while transport continued elsewhere. CEVA hasn't disclosed the entry vector or the full scope.
What makes this incident worth a second look isn't the attack itself. It's the notification list that followed.
The client list is the actual story
Valve warned European Steam hardware customers that names, addresses, phone numbers, and order details were likely stolen. Bol halted data exchanges with CEVA and saw orders cancelled or delayed at an affected fulfilment centre. De Bijenkorf, Ajax, ING, and Ace & Tate all reported exposed customer shipping data. A gaming hardware company, a major e-commerce retailer, a department store, a football club, a bank, and a fashion retailer: six organisations across five industries, all now managing customer notifications because of an incident at a company none of their customers had ever heard of.
None of that data was exotic. Names, addresses, phone numbers, order values. Nothing that would headline a breach report on its own. But it's exactly sufficient to run convincing delivery-fee phishing against people who hold no direct relationship with the company that lost their data. They'll recognise Bol or Valve, not CEVA, which makes the resulting phishing emails considerably more credible than the generic kind.
Where vendor risk scoring usually stops
Contract logistics vendors get evaluated the way logistics vendors get evaluated: on-time delivery rates, damage rates, warehouse capacity, geographic coverage. Operational SLA. Security review, where it exists at all for this category of vendor, tends to focus on whether the warehouse itself is physically secure, which is a reasonable thing to check and almost entirely beside the point here.
CEVA wasn't hired to protect data. It was hired to move and store goods. But moving and storing goods, in a modern fulfilment relationship, means CEVA's systems hold order details, shipping addresses, and customer contact information for everyone whose products pass through those warehouses. The security posture of that data pipeline was never part of the vendor conversation, because nobody framed CEVA as a data processor. It functioned as one anyway.
The clause that's missing
If a vendor risk register scores logistics partners on operational SLA alone, this is the case for adding data custody terms to the next renewal. Not as a favour to the vendor relationship, but because the exposure clearly travels downstream regardless of whether the contract anticipated it. That means specifying what customer data the vendor will hold, how it's segmented from other clients' data, what breach notification timelines apply, and who bears the cost of the notification cascade when, not if, something goes wrong at scale.
The six companies notifying customers after the CEVA incident didn't choose a security vendor. They chose a warehouse operator. The data exposure came bundled in, unpriced and unreviewed, because nobody had asked the question that would have surfaced it.
