Blog
A supply chain nightmare: how one logistics provider exposed the hidden risks of third-party concentration
A cyberattack on CEVA Logistics exposed how a single compromise at a shared service provider can trigger security, regulatory and reputational consequences for multiple organisations. While the affected companies were not themselves breached, the incident demonstrates how third-party cyber risk and supplier concentration can create widespread exposure. This blog explores the lessons security teams should take from the incident, from managing vendor dependencies and protecting customer data to strengthening resilience against supply chain attacks.
Jump to:
What we know about the CEVA Logistics cyberattack
Third-party cyber risk: when customers inherit someone else’s breach
Why exposed delivery data still creates security risks
The bigger issue: supply chain concentration risk
How organisations can reduce third-party cyber risk
Why the CEVA incident matters beyond logistics
A cyber intrusion at CEVA Logistics has turned into a multi-company disclosure event across Europe, affecting organisations including Valve, Bol, De Bijenkorf, Ajax, ING and Ace & Tate. However, the affected organisations were not themselves breached – their customers’ information was exposed because CEVA processed that data while providing logistics and fulfilment services.
CEVA confirmed that the incident affected part of its European contract logistics operation. Eight warehouses were disrupted, while the company said its air, ocean, ground and rail transportation management operations continued normally. The investigation remains ongoing, and the full scope has not yet been publicly disclosed.
The incident demonstrates a form of cyber risk that is easy to underestimate: a single technology compromise inside a shared service provider can generate operational disruption, data exposure, regulatory reporting and customer notifications across organisations that otherwise have little in common.
What we know about the CEVA Logistics cyberattack
Valve has provided one of the clearest timelines available so far, stating that the cyberattack affected CEVA between 29 July and 1 August 2026. The affected data reported by customers is primarily information required to fulfil deliveries, including names, postal addresses, telephone numbers, email addresses and order details.
Importantly, there is currently no evidence that the affected retailers, bank, football club or gaming platform were themselves compromised. Valve, Bol and De Bijenkorf have all stated that payment credentials and their own systems were not affected.
That distinction matters. This incident is not currently evidence of compromise across multiple organisations. It is evidence that data entrusted to a common logistics provider created a shared exposure.
Third-party cyber risk: when customers inherit someone else’s breach
One of the more revealing aspects of the incident is where the disclosure burden has landed.
Much of the useful public information has come from CEVA’s customers. Valve supplied the clearest intrusion dates and exposed data categories. Bol described which logistics systems were affected and suspended data exchange with CEVA. Other organisations have also issued their own notifications to affected customers.
For the consumers receiving these notifications, CEVA may be a company they have never heard of. They bought a product from a retailer, ordered Steam hardware, purchased merchandise from a football club or redeemed an item through a banking rewards programme. Yet their personal information entered another organisation’s infrastructure because fulfilment required it.
This is third-party risk in its most operational form. The organisation suffering the original security incident and the organisation carrying the customer relationship are not the same.
Contracts can transfer responsibilities, but they cannot transfer reputational impact.
Conscia ThreatInsights
Latest ThreatInsights
Why exposed delivery data still creates security risks
The absence of payment card data, banking credentials and passwords materially limits some forms of direct fraud. It does not make the exposed dataset harmless.
Delivery information is particularly useful for targeted phishing and social engineering because it provides attackers with context that victims expect to be legitimate. A malicious message can reference a real name, delivery address and recent purchase while impersonating the retailer, logistics company or courier.
Valve explicitly warned affected customers to expect fraudulent emails, SMS messages or phone calls referencing their hardware orders, potentially requesting redelivery fees, customs payments or account verification.
This matters because many phishing campaigns fail when the pretext is generic. Shipment data solves that problem. The attacker no longer needs to guess whether someone is expecting a parcel.
The same principle applies to business relationships. Knowledge of genuine suppliers, deliveries, customer contacts and fulfilment processes can support more convincing business email compromise, supplier impersonation and invoice fraud.
The bigger issue: supply chain concentration risk
CEVA operates more than 1,000 warehouses worldwide and generated approximately $18.3 billion in revenue in 2025. Its scale is precisely what makes this incident strategically relevant.
Large logistics providers create enormous efficiencies by centralising warehousing, fulfilment and transportation operations for many organisations. They also create concentration.
A compromise does not need to penetrate ten separate retailers if the same data from those retailers converges inside one service provider.
Traditional third-party risk programmes often evaluate suppliers individually. Security leaders should also ask a different question: Which suppliers represent concentrated dependencies across our customer data, operations or revenue?
The same reasoning applies beyond logistics. Identity providers, payroll processors, managed service providers, cloud platforms, payment processors and software supply chains can all become points where otherwise independent risks become correlated.
How organisations can reduce third-party cyber risk
Organisations should begin by identifying where customer and operational data leaves their direct control. Procurement records, privacy processing inventories and contractual documentation may provide a more accurate view than the security asset inventory alone.
Supplier contracts should define clear incident notification requirements and escalation paths. Vendor-held identities should use strong authentication, conditional access and least privilege. Where providers connect directly into corporate environments, organisations should continuously reassess whether those access paths remain necessary.
Finance and accounts payable teams should also be briefed when a logistics or supplier breach exposes transaction-related context. Any request to change payment details should be verified using previously established communication channels, regardless of how convincing the accompanying order or shipment information appears.
Cyber Threat Intelligence can add another layer by monitoring criminal marketplaces, leaked datasets, impersonation infrastructure and subsequent campaigns to determine whether exposed information is being operationalised by attackers. MDR teams can then correlate those external signals with identity, email, endpoint and network telemetry to identify whether attempted exploitation has progressed into compromise.
Why the CEVA incident matters beyond logistics
Organisations may successfully secure their own infrastructure and still inherit exposure from the companies that warehouse their products, process their payroll, host their applications or administer their systems.
Third-party security therefore cannot stop at asking whether a supplier is secure. Mature risk management also needs to ask what happens when that supplier is not, and how many parts of the organisation fail at the same time.
Guide: Secure AI 2026 – effective & future-proof AI
Cut through the hype and standalone technical fixes. Deepen your understanding of AI by recognising that it is not merely a matter of innovation or security, but of governance, responsibility, and lon…
About the author
David Kasabji
Head of Threat Intelligence
David Kasabji is the Head of Threat Intelligence at the Conscia Group. He leads the development and delivery of actionable intelligence across cyber defense and managed security operations, translating complex threat activity into clear outcomes for different audiences — from SOC analysts and incident responders to executive stakeholders and external communications. His work spans end-to-end intelligence operations: collection and analysis of adversary activity, threat actor and campaign profiling, IOC and TTP development, and intelligence-driven guidance for detection, threat hunting, and security prioritization. David is also actively involved in Digital Forensics and Incident Response, supporting investigations and crisis situations with rapid triage, context, and strategic recommendations. A strong focus of his role is continuously improving how intelligence is operationalized through standardization and automation to ensure it is timely, relevant, and measurable.nd strategic crisis management during incidents.
Related
