CEVA Logistics, eight warehouses down: dependent interruption through logistics

On 29 July 2026 an attack on CEVA Logistics stopped at least eight European warehouses, blocking goods of customers such as Bol, de Bijenkorf and Valve and exposing their customers' data. The analysis: goods stuck in someone else's warehouse, customer data at the supplier, aggregation in logistics and questions for renewals.

Archive: reconstruction written in November 2026

Topic of the month, August 2026 · by cybercoverinsurance

On 29 July 2026 a cyber attack hit CEVA Logistics, the logistics group owned by French shipping company CMA CGM. At least eight European warehouses stopped and on 1 August CEVA told customers that goods held at those sites could not be shipped. Customers affected included Dutch online retailer Bol, the de Bijenkorf department stores and Valve, which delivers Steam hardware in Europe through CEVA. End customers' data was also exposed.

For cyber underwriters the case is an example of dependent business interruption in logistics: companies that were not attacked, but cannot deliver because their goods are stuck in a supplier's warehouse. On top of that comes a breach of their customers' data, held by the supplier.

What is known

The attack. CEVA told TechCrunch the attack most likely began on 29 July. At least eight warehouses in Europe were affected. CEVA operates in more than 170 countries and had 18.3 billion dollars in gross revenue the previous year (TechRadar). On 1 August the company told customers that goods at the affected sites could not be shipped. It gave no technical details and did not name the attacker, and no group had claimed the attack by mid-August (Security Affairs).

The customers. Bol said its own systems had not been touched, but two systems used to handle orders at a CEVA site had been hit: goods at that site had been taken off sale and restoration was taking longer than expected. De Bijenkorf kept its stores open, warning that online orders, returns and refunds could be slower. Valve explained that CEVA keeps Steam hardware delivery data for up to 90 days, and that names, addresses, phone numbers, emails and product type and price were likely compromised (TechRadar).

The data. De Bijenkorf said names, contact details, order data and in some cases VAT numbers might be exposed, but not payment data or passwords. The Dutch data protection authority had received ten breach notifications (TechRadar). A dark web seller offered what it said was CEVA's database, with customer lists, shipments, contracts, prices and bank details; the claim has not been confirmed (Security Affairs).

What is not known. The type of attack, the perpetrator, any ransom demand, how long the warehouses were down and the cost to CEVA and its customers have not been made public.

Goods stuck in someone else's warehouse

The non-IT supplier. CEVA is not a software or cloud provider, but a logistics operator. For customers, the warehouse outage has the same effect as an IT outage: no shipments, no sales. Dependent business interruption covers limited to IT suppliers do not respond.

Blocked goods. Bol took goods held at the affected site off sale (TechRadar). For an online seller, goods blocked in an external warehouse are lost revenue until the warehouse restarts. The loss lasts as long as the supplier's recovery, which the customer does not control.

The indemnity period depends on the supplier. Restoration of Bol's site was taking longer than expected (TechRadar). For the insured, the length of the claim depends entirely on a third party's response. A dependent business interruption cover with a short indemnity period may not be enough.

Customer data at the supplier

The breach comes from outside. Valve and de Bijenkorf had to warn their own customers of a breach at CEVA (TechRadar). For the insured, notification obligations remain its own, even if the data was held by a supplier.

The supplier keeps more data than needed. CEVA kept delivery data for up to 90 days (TechRadar). Each extra day of retention increases the number of people involved in a breach. Contracts with logistics suppliers should limit retention to what is strictly necessary.

Recourse against the supplier. CEVA's customers may try to recover notification costs and losses. Logistics contracts usually limit liability, and logistics often excludes or limits indirect damage. For the customer's insurer, recourse is possible but uncertain.

Aggregation in logistics

One operator, many customers. Eight European warehouses of a single operator served different customers: e-commerce, department stores, consumer electronics (TechRadar). For a portfolio of retail companies, a large logistics operator is an aggregation point like the cloud.

The data point rarely collected. The questionnaire asks about critical IT suppliers, almost never about logistics operators. Yet for many retailers the external warehouse is the supplier on which all revenue depends.

The shipping group behind it. CEVA is part of CMA CGM (Security Affairs). The maritime and logistics sector has been hit repeatedly in recent years, from attacks on ports to the n0n case in October 2026. Risk for customers is concentrated on a few large groups.

What to bring to renewals

Impact for insurersMedium

An attack on CEVA Logistics stopped at least eight European warehouses, blocking goods of customers such as Bol, de Bijenkorf and Valve and exposing data of their end customers.

On the portfolio side, the CEVA case suggests collecting the names of the main logistics operators of retail and industrial insureds, and including in aggregation tests a scenario of several warehouses of a large operator going down, with dependent business interruption and breach notifications for many customers at once.