Data breach at Ceva Logistics impacts bol, de Bijenkorf, and ING customers

A significant data breach has occurred at Ceva Logistics, a major logistics provider for prominent Dutch companies including bol, de Bijenkorf, and ING. This incident follows an earlier data theft at Odido and raises concerns about the security of personal data handled by third-party logistics firms.

While Ceva Logistics has not responded to inquiries, de Bijenkorf was the first to notify its customers about a "security incident" affecting a logistics partner. Subsequently, bol, the largest online retailer in the Netherlands, and ING also reported cyber incidents involving Ceva. ING clarified that the breach is separate from its banking systems and potentially affects customers who purchased physical items from its ING Puntenwinkel webshop.

According to bol, two of Ceva's systems were compromised. The affected systems are used at one of bol's five distribution centers, located in Waalwijk. As a precautionary measure, all operations at this center have been suspended, halting order processing and preventing new inventory from being delivered. Bol indicated that data potentially stolen includes information necessary for order fulfillment and delivery, such as names, addresses, contact details, product information, and tracking links.

Reports suggest that criminals have already put the stolen data up for sale online, with the hack possibly occurring in early May. The exact number of affected individuals and the duration of the hackers' access remain unclear. Bol has sent warning emails to customers who ordered products recently processed through the affected center, while de Bijenkorf has notified customers who placed orders even years ago. ING has also issued a precautionary warning to all customers who have ever purchased a physical product.