A data breach at one of the world’s biggest logistics companies appears to have had a significant impact on its wider supply chain ecosystem of customers.
Ceva Logistics is a subsidiary of the French CMA CGM Group, which is the world’s third-largest shipper.
A brief statement from the firm seen by Infosecurity claimed its European contract logistics operations were impacted by the breach. This part of the business provides customers with warehousing and fulfilment, manufacturing support and aftermarket services.
The statement said Ceva notified impacted customers on August 1, with eight warehouses affected.
“No other Ceva systems globally were affected, and all other operations continue without incident,” it added
Read more on logistics breaches: UK Logistics Firm Forced to Close After Ransomware Breach
An email sent by Ceva client, video game developer Valve, to its customers and republished online claimed the cyber-attack lasted from July 29 to August 1.
“Ceva receives specific delivery-related information from Steam to be able to ship physical hardware to customers in Europe, and told us these are the details the attacker likely took,” it explained. “Because Ceva retains this information for up to 90 days after that order, we are sending this message to all customers we can assume were impacted.”
In this case, hackers may have obtained names, email and home addresses, phone numbers and order details.
Aside from the gaming specialist, other Ceva clients impacted by the incident include Dutch online retail firm Bol, which said restoration of operations at Ceva’s Veerweg location is taking longer than anticipated, and may impact service levels.
Dutch department store chain De Bijenkorf was also impacted, as was football club Ajax and banking giant ING.
Logistics Under Fire
The logistics sector is an obvious choice for cybercriminals, argued Joseph Perry, cybersecurity researcher and advanced services lead at Arcova.
“They sit at the center of thousands of transactions between businesses and their customers. That makes them an appealing target because a compromise can create operational problems while also giving attackers access to information about the people and products moving through the system,” he argued.
“Shipping information is also highly contextual. A name, address, phone number, email address, and recent purchase can give attackers enough context to make phishing and impersonation attempts far more convincing.”
These companies should be treated as “part of the security and operational environment” of all those that depend on them, said Perry.
“You do not have to be the final target to become the point of failure,” he added.
KnowBe4 CISO advisory, Anna Collard, described the incident as a “textbook supply chain breach.”
“I’d expect a wave of ‘delivery problem’ lures over the coming weeks, messages about a redelivery fee or a request to ‘verify’ an order,” she added. “So treat any unexpected message about this order as fake, don’t click links or pay fees, and go directly to the retailer’s official site by typing the address yourself.”
In 2020, CMA CGM suffered a ransomware attack on its servers, leading to the temporary closure of its shipping website and applications.