Loading story…
Dutch retailer Bol warned customers that some personal information may have been viewed or copied after unauthorized parties accessed systems at CEVA Logistics, a logistics partner that processes and delivers orders from one of Bol’s distribution centers. Bol said its own environment was not compromised, but customer data linked to the partner’s operations was affected, and reports indicated the stolen information was being offered for sale on the dark web.
The disclosure followed a similar warning from De Bijenkorf, which also linked its incident to a logistics partner and said the breach likely affected customer data. Reporting suggested the two cases are related, pointing to a broader third-party supply-chain compromise centered on CEVA Logistics, with De Bijenkorf also experiencing order-processing delays as the incident disrupted operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Reporting indicated that data connected to the retailer breaches was being offered for sale on the dark web. The reporting linked the leaked data to the incidents affecting Bol and De Bijenkorf via a logistics partner.
Bol disclosed a data breach affecting customer information through logistics partner CEVA Logistics, saying unauthorized parties accessed the partner’s systems rather than Bol’s own environment. Bol said some customer information may have been viewed or copied.
De Bijenkorf reported a possible data breach involving a logistics partner. Reporting indicated the partner was likely CEVA Logistics, and the incident caused delays in processing customer orders.
A cyberattack struck eight European warehouses operated by CEVA Logistics, disrupting order processing and exposing customer data linked to Bol and De Bijenkorf. CEVA notified affected customers the same day, while broader transportation management operations were reportedly unaffected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor using the alias **"Jeffrey Epstein"** claimed to have stolen data on more than **400,000 Belgian customers** of Dutch online retailer **Bol** and advertised the dataset for sale on a dark web forum. Reports said the actor published a sample to support the claim and directed prospective buyers to negotiate through **Telegram** or **Session**. The allegedly exposed records include names, birthdates, phone numbers, email addresses, physical and shipping addresses, tracking numbers, order history, and some payment-related details, though reports said **passwords and bank or financial data were not included**. Bol said it was taking the claim seriously but had **no evidence of a hack or attack**, that its systems were operating normally, and that **no ransomware** was involved; if the data is genuine, it could be used in phishing, identity theft, and fraud targeting affected customers.
Jun 29, 2026
Valve has notified European customers who bought Steam hardware that personal delivery and order data was likely stolen after a cyberattack on shipping partner **CEVA Logistics**. The company said attackers had access to CEVA servers between **July 29 and August 1, 2026**, exposing names, addresses, phone numbers, email addresses, and the type and price of ordered products tied to Steam hardware shipments, including older purchases such as Steam Machines and Steam Controllers. Valve said the breach was limited to fulfillment data held by CEVA and did **not** expose Steam account credentials, payment card information, or **Steam Guard** codes. The company warned affected customers to expect phishing emails, text messages, and phone calls impersonating Valve, Steam, or delivery firms, including scams requesting customs or delivery fees or login details. CEVA said it isolated affected systems, notified data protection authorities, and brought in external investigators after the attack also disrupted operations at eight European warehouses.
Aug 11, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026