CEVA Logistics 2026: ransomware and exposed customer data

What happened

• July 29 to August 1, 2026: ransomware on the systems of eight European warehouses. Air, ocean, road and rail transport keep running; warehousing and contract logistics are hit (delays, blocked orders, cancellations).
• Data exfiltrated: end-customer contact details, order details and company VAT numbers. According to published reports, no payment cards or passwords.
• Aftermath: class actions in the United States, including one on behalf of employees alleging exposure of social security numbers and bank details. The CoinbaseCartel group is named in at least one proceeding, without official confirmation.

The flaw on the client side: too much data at the vendor

The affected brands were not hacked. Their customers are exposed because their data sat with a vendor. Three weaknesses make that risk worse.

1. Oversharing

The integration sends the logistics provider the full order, purchase history, VAT number and sometimes internal notes, when a delivery address, a phone number and a list of items are enough to ship.

2. Overpowered integration keys

The API key given to the vendor to read orders also lets it list every customer, change addresses or reach other resources. If the vendor is compromised, the attacker inherits those rights in your systems. The same principles apply to webhooks, covered in our article on webhook signatures.

3. No detection of a compromised third party

Nobody monitors how the vendor's key behaves: call volume, hours, IP addresses. Abnormal use goes unnoticed until the data is published. You then learn about the incident from the press or from your own customers, with no way of saying which records left, because the only logs that exist are on the vendor's side.

The general principle is developed in our article on supply chain attacks.

Why it is your problem

For your customers, the brand responsible is yours. So are the obligations: under the GDPR, the vendor is usually your processor, and it is up to you to choose processors offering sufficient guarantees and to report the breach. Your customers will not distinguish between your systems and those of a provider they have never heard of.

The flaws on the vendor side

Since the entry point is unconfirmed, we cannot say which one played a role here. Today's ransomware does, however, rely on well-known prerequisites: remote access without MFA, unpatched internet-facing appliances, too many privileged accounts, a flat network between office IT and operational systems, and backups reachable from the compromised network. The methods of active groups are described in our overview of the 2026 ransomware ecosystem.

How to test it in your own systems

If you hand data to a vendor:

1. List the fields sent to each vendor (logistics, payroll, archiving, support) by reading the actual payloads of API calls or uploaded files, and compare with the strict minimum.
2. Test each integration key's permissions: with the vendor's key, call the list, update and export routes. Anything that answers beyond the need should be restricted.
3. Check revocation: how long does it take to disable a compromised vendor's key, and who can do it on a Sunday?
4. Measure detection: with a test key, simulate ten times the normal call volume from an unusual address. Does an alert fire?
5. Reread the contract: incident notification deadline, audit rights, deletion of data at the end of the contract.

If you are the vendor:

1. Check MFA on all remote access and privileged accounts.
2. Cross-check your internet-facing appliances against CISA's KEV catalog.
3. Test restoring a backup that is isolated from the main network.
4. Check the separation between the office network and warehouse systems.

AI agents and the CEVA Logistics attack: what changes

Logistics and e-commerce platforms are deploying AI agents to track orders, answer customers and handle exceptions. These agents often get the same broad integration key as the vendor, and they read external content (carrier emails, delivery documents). A prompt injection in a delivery note or an email can make the agent list orders, change a delivery address or export contact details. Give the agent a key limited to the orders in the current conversation, and require approval for any address change.

To check what an agent connected to your orders can do once manipulated, the Agent Red Team Express tests these scenarios in five days.