CEVA Logistics breach exposes customer data at Dutch retailers Bol and De Bijenkorf

Dutch online retailer Bol and department store chain De Bijenkorf have warned customers that personal data — including names, addresses, postcodes and phone numbers — may have been stolen in a cyberattack on their shared logistics provider CEVA Logistics, broadcaster NOS reported.

Bol said its own systems were not compromised and that the breach is confined to orders handled by a single distribution centre. As a precaution, Bol has taken offline products handled by CEVA Logistics, cancelled some orders and halted data exchange with the firm. The company confirmed there is no indication that payment details, passwords or login credentials were affected.

CEVA informed Bol of the possible breach on 1 August. The Dutch data protection authority (AP) was notified on 3 August, but customers were only emailed on Wednesday. A Bol spokesperson told NOS the company wanted to establish first what had happened and who was affected, rather than contacting people repeatedly.

De Bijenkorf blocked access to the affected systems, applied additional security measures and commissioned an external investigation. The chain warned customers to expect delays to orders, returns and refunds, and said email addresses and product information may also have been taken. De Bijenkorf confirmed that no bank account numbers or passwords had been exposed.

Neither company disclosed how many customers may be affected.