A data breach at logistics firm CEVA Logistics has spread to affect several prominent Dutch brands, including football club Ajax, financial institution ING, and eyewear company Ace & Tate.
The incident originally surfaced when online retailer Bol and department store chain De Bijenkorf alerted customers that their personal information may have been compromised.
Customer details potentially exposed
CEVA handles order fulfilment and distribution for the affected companies, requiring access to customer records to process deliveries.
The logistics provider confirmed it cannot rule out that personal data was leaked during the breach. However, the companies involved have stated that sensitive credentials such as passwords, usernames, and payment details were not accessed.
It remains unclear whether names, street addresses, email addresses, or phone numbers were exposed in the incident.
Impact across services
At ING, the issue is limited to customers who used their loyalty points to order physical merchandise through the bank’s rewards program.
In response to the leak, Ajax has advised fans to exercise caution and stay alert for potential phishing attempts over the coming weeks.
Both Ajax and Ace & Tate have reported the incident to the Dutch Data Protection Authority, following similar filings made earlier by other affected businesses. The Dutch privacy regulator recently raised concerns in another domain when the privacy regulator warned app users about data risks.
Ongoing operations
Ace & Tate noted that while its online store remains operational, customers might experience delays in current deliveries.
CEVA Logistics has indicated that it plans to issue a formal response regarding the security breach at a later time.
