News and Analysis

A data breach at Ceva Logistics, one of the world’s largest shipping firms, has hit several of its customers including Valve.Valve has confirmed the attack, which took place between July 29 and August 1, and is notifying customers in Europe that their data has been stolen. Only those who bought Steam hardware in the past three months – the period for which Ceva holds delivery information – are believed to be affected. The company is warning customers to be on the alert for scammers: “They may quote your address back to you to prove they’re genuine. They may ask you to confirm a delivery, pay a small customs or redelivery fee, or sign in somewhere to ‘verify’ your order. Treat all of them as fake,” Valve said in an advisory.It’s not yet known how the breach took place, but speculation suggests it could have occurred through a social engineering attack. Ceva is yet to issue a statement on the incident. ITPro approached Ceva Logistic for comment, but did not receive a response by time of publication.”Ceva is still investigating the incident, but as Valve learned on August 7, certain information about Steam customers, including you, was likely compromised,” Valve said.What data was impacted in the CEVA breach?According to Valve, the company is “pressing Ceva for the full scope of what was taken and how”. Data believed to have been impacted in the breach includes names, addresses, phone numbers, and email addresses. Details on the type and price of products purchased by customers are also thought to be included. No other data was accessed, according to Valve, and customers aren’t required to change passwords. Regardless, the type of information exposed still poses a threat to customers, according to Anna Collard, CISO advisor and SVP of content strategy at KnowBe4. “When a scammer can quote your real address and reference the exact device you bought, they borrow the legitimacy of the real brand and bypass the mental shortcuts we rely on to spot a fake,” she said.”I’d expect a wave of ‘delivery problem’ lures over the coming weeks, messages about a redelivery fee or a request to ‘verify’ an order. So treat any unexpected message about this order as fake, don’t click links or pay fees, and go directly to the retailer’s official site by typing the address yourself.”Who else has been affected?Other companies affected by the breach are believed to include ING Bank, Levi Strauss, and several smaller European firms including Dutch retail firms Bol and De Bijenkorf, football club Ajax, and glasses maker Ace & Tate. “People often overlook logistics companies as cyber targets, but they sit at the center of thousands of transactions between businesses and their customers,” said Joseph Perry, cybersecurity researcher and advanced services lead at Arcova.”Every company that relies on a logistics partner should be asking what information that partner can access, how long it retains it, what happens if its systems go down, and whether the business could continue operating without it. You do not have to be the final target to become the point of failure.”FOLLOW US ON SOCIAL MEDIA