A data breach at shipping giant Ceva Logistics is rippling across banks, retailers, Steam gamers, and beyond

The hack at Ceva also resulted in a data breach, affecting a large amount of personal information belonging to retail customers that Ceva relies on for delivering goods to people’s home addresses. Several companies reported that hackers took their customers’ names, home addresses, phone numbers, and email addresses used to place their orders from Ceva’s systems.

Dutch online retail giant Bol said on its website that hackers gained access to systems of its warehousing partner, Ceva, and warned that their customers’ data may have been taken. Bol also said that it expects delays and some customer orders to be cancelled as a result of the incident.

De Bijenkorf, another Dutch luxury retailer, similarly confirmed order delays following the theft of its customers’ data, per local media. Football club Ajax, banking giant ING, and eyeglass maker Ace & Tate also reported that customers’ shipping information was affected. 

Video game giant Valve told customers that it learned on August 7 that data was taken from Ceva’s systems, and alerted customers who recently bought its Steam hardware that they had personal information taken in the incident. Valve said in its note to customers, posted to Reddit, that Ceva stores their shipping and delivery information for 90 days following their order.

Valve spokesperson Doug Lombardi did not respond to a request for comment about the incident. 

Ceva confirmed in a statement to TechCrunch that it was experiencing a cyberattack.

“On Aug. 1, CEVA Logistics confirmed to affected customers that a cyber intrusion was impacting part of its European contract logistics operations. As soon as the incident was identified, CEVA’s cybersecurity teams immediately activated its security protocols and launched a thorough investigation, which is still ongoing,” per the statement provided to TechCrunch. “The operational impact is limited to eight warehouses. No other CEVA systems globally were affected, and all other operations continue without incident.”

Ceva spokesperson Ryan Fisher would not answer TechCrunch’s questions about the incident, such as if the company knows how much personal data was taken, or if Ceva has received any communication from the hackers, such as a ransom demand.

Ceva said some of its affected applications and services are back online, and that it was working with the authorities. Ceva’s website was not properly loading at the time of publication on Monday.

Authorities in the Netherlands are said to be investigating the incident. 

Mark Schenkel, a spokesperson for the Dutch data protection authority, did not respond to TechCrunch’s request for comment on Monday about the incident.