Ace & Tate Reports Data Breach Linked to Logistics Partner Eyewear retailer Ace & Tate has notified customers of a data breach stemming from a security incident at an unnamed logistics partner. The breach, reported to the Dutch Data Protection Authority, follows a pattern seen in recent disclosures from Bijenkorf, Bol, ING, and Ajax suggesting possible involvement of CEVA Logistics. While financial data, usernames, and passwords were not exposed, compromised information may include names, shipping and billing addresses, email addresses, phone numbers, order details, and track-and-trace data. The company has warned customers to remain cautious of potential phishing attempts. No further details on the timeline or scope of the breach have been disclosed.

Cyberattack on CEVA Logistics Exposes Bol Customer Data A cyber incident targeting CEVA Logistics, a logistics and warehousing partner for Dutch online retailer Bol, has potentially exposed customer data. The breach was first flagged by De Bijenkorf, which had previously issued warnings about a similar incident involving the same company. Bol confirmed that its own systems remained unaffected, but customer information including names, addresses, phone numbers, email addresses, and order details may have been accessed or stolen. Payment details and passwords were not compromised. Affected customers are being notified directly. As a precaution, Bol temporarily took offline the product range of its sales partners linked to the affected site, leading to order cancellations and delays. CEVA Logistics also handles orders for other retailers, though it remains unclear whether their customers were impacted. The incident highlights the risks of third-party supply chain vulnerabilities in logistics operations.

Pokémon Center Customer Data Exposed in Third-Party Breach via CEVA Logistics The Pokémon Center, the official retailer for Pokémon merchandise, confirmed a data breach stemming from a cyberattack on its logistics partner, CEVA Logistics. The incident, which occurred on July 30, exposed customer order details including names, email addresses, phone numbers, and physical addresses for orders shipped to the United Kingdom and Germany. While the Pokémon Center’s systems were not directly compromised, the breach disrupted operations, leading to delivery delays and cancellations for some customers. Payment card information was reportedly not affected. CEVA Logistics, which handles shipping for the retailer, notified the Pokémon Center of the attack, though the full scope of the breach and its impact on other clients remains unclear. The incident underscores the growing risk of third-party supply chain attacks, where vulnerabilities in partner networks can expose sensitive customer data. No further details on the attack’s origin or the number of affected individuals have been disclosed.

Steam Hardware Customers in Europe Warned of Phishing Risks After CEVA Logistics Cyberattack Valve has alerted European customers who purchased Steam hardware such as the Steam Deck or Steam Machine of potential phishing attempts following a cyberattack on its logistics partner, CEVA Logistics. The breach, detected on August 7, 2026, occurred between July 29 and August 1, exposing customer data held by CEVA for order fulfillment. The compromised information includes names, addresses, phone numbers, email addresses, and details about ordered products (type and price). However, Valve confirmed that sensitive data such as payment details, passwords, and Steam Guard codes was not accessed, as CEVA does not store this information. Valve warns customers to expect fraudulent messages via email, SMS, or phone, impersonating Steam, Valve, or delivery services. Attackers may demand fake customs or delivery fees or direct victims to phishing portals. Valve advises verifying URLs (e.g., help.steampowered.com for support) and avoiding embedded links in suspicious messages. The company also reiterated that legitimate Steam communications will never request passwords or Steam Guard codes. CEVA has isolated the affected systems, notified data protection authorities, and engaged external investigators to assess the incident. The breach underscores the risks of third-party supply chain attacks, even when primary platforms remain secure.

Cyberattack on Ceva Logistics Exposes Employee Data, Sparks Class Action Lawsuit A former employee has filed a class action lawsuit against Ceva Logistics, alleging the global freight provider failed to safeguard sensitive personal data stolen in a July cyberattack that disrupted operations across eight warehouses in the Netherlands and Europe. The breach, attributed to the CoinbaseCartel ransomware group, compromised employee information, including bank account details and Social Security numbers. The lawsuit, filed in late August in the U.S. District Court for the Southern District of Texas, claims Ceva neglected to implement adequate security measures despite a prior ransomware attack in September 2025, which the company never publicly disclosed. The complaint also alleges Ceva has not formally notified affected employees, leaving them vulnerable to fraud with the plaintiff reporting credit card fraud and increased spam calls as direct consequences. The filing seeks class action status, citing at least 100 impacted employees (potentially thousands) and demanding $5 million in damages for alleged negligence, breach of contract, and unjust enrichment. The lawsuit argues Ceva prioritized cost-cutting over security, using "cheaper, ineffective measures" that left data exposed. The incident coincides with leadership changes at Ceva, including the departure of two IT executives VP of IT Infrastructure Bryant Duke (November 2025) and Global CIO Susanne Shustein (March 2026). Parent company CMA CGM Group also reassigned Ceva’s CEO, Mathieu Friedberg, to a new role overseeing cybersecurity transformation, signaling broader concerns about enterprise-wide vulnerabilities. Healthcare Sector Also Targeted In a separate incident, McKesson Corp. confirmed a cybersecurity breach last week, with hackers allegedly the ShinyHunter group stealing customer and employee data from two business units. The group is demanding a $55 million ransom to prevent public release. McKesson joins a growing list of healthcare and medical device firms hit by ransomware in 2026, including Boston Scientific, which suffered a network outage in a recent attack.