{"meta":{"project":"France Cyberwatch 2025-2026","reviewedThrough":"2026-08-16","schemaVersion":"1.3.0","scope":{"en":"Curated public-interest dataset of major publicly reported cyberattacks and data breaches affecting French public institutions and companies in 2025 and 2026. It is not a complete register. Unknown or disputed victim counts are not converted into confirmed statistics.","fr":"Jeu de données d’intérêt public sur les principales cyberattaques et fuites de données rendues publiques touchant des institutions publiques et des entreprises françaises en 2025 et 2026. Il ne constitue pas un registre exhaustif. Les nombres de victimes inconnus ou contestés ne sont pas convertis en statistiques confirmées."},"methodology":{"en":"Prefer official disclosures. Keep unknown values as null. Keep disputed attacker claims in labels or notes rather than numeric fields used for charts. Do not attribute attackers unless public evidence supports the attribution.","fr":"Privilégier les communiqués officiels. Conserver les valeurs inconnues à null. Garder les revendications contestées dans les libellés ou notes plutôt que dans les champs numériques utilisés pour les graphiques. Ne pas attribuer une attaque sans éléments publics suffisants."},"rules":{"affectedCounts":{"en":"Plot only incidents where affected is a non-null numeric value.","fr":"Ne représenter que les incidents dont le champ affected est une valeur numérique non nulle."},"unknownCounts":{"en":"Display as Unknown / under investigation, never as zero.","fr":"Afficher comme Inconnu / sous enquête, jamais comme zéro."},"disputedClaims":{"en":"Do not include disputed attacker-claimed victim counts in aggregate charts.","fr":"Ne pas inclure les nombres de victimes revendiqués et contestés dans les graphiques agrégés."}},"lang":"en"},"incident":{"id":"ceva","date":"2026-07-29","year":2026,"org":"CEVA Logistics","domain":"cevalogistics.com","kind":"company","sector":"Logistics / supply chain","sectorLabel":"Logistics / supply chain","severity":"high","status":"confirmed","affected":null,"affectedLabel":"Unknown person count; eight European warehouses","data":"Delivery data for downstream clients: names, addresses, phones, emails and order details.","method":"Initial access not publicly confirmed.","risk":"Supply-chain blast radius and tailored package scams.","confidence":"Confirmed by CEVA to customers and press; technical details limited","sourceName":"TechCrunch","sourceId":"cevaTechcrunch","sourceUrl":"https://techcrunch.com/2026/08/10/a-data-breach-at-shipping-giant-ceva-logistics-is-rippling-across-banks-retailers-steam-gamers-and-beyond/","sourceIds":["cevaTechcrunch","cevaVerge","cevaPcgamer","cevaComputing","ceva"],"lastResearched":"2026-08-16","url":"/incident/ceva","detail":{"lead":"A cyber intrusion hit part of CEVA Logistics’ European contract-logistics operation beginning around 29 July 2026. CEVA told affected customers that the incident was identified on 1 August and later confirmed to press that the operational impact was limited to eight European warehouses.\n\nThe breach became visible through CEVA’s customers. Downstream retailers and Valve, which uses CEVA to ship Steam hardware in Europe, warned that shipping information held by CEVA had been accessed or copied. No public person count has been established.","timeline":[{"date":"2026-07-29","label":"Start of the intrusion window later communicated in Valve-related notices and reporting."},{"date":"2026-08-01","label":"CEVA identifies the intrusion, activates security measures and informs affected customers. Operational impact is later described as limited to eight European warehouses."},{"date":"2026-08-07","label":"Valve says it learns that information relating to its European hardware customers was likely compromised. CEVA retained Valve delivery information for up to 90 days after an order."},{"date":"2026-08-10","label":"TechCrunch and other outlets detail the multi-client impact. Valve begins broad customer notification."},{"date":"2026-08-12","label":"Additional reporting identifies more affected retailers and notes that the Dutch data-protection authority has received multiple breach notifications connected with the CEVA incident."}],"how":"CEVA has not published an initial access method, vulnerability, ransomware family or attacker. Physical operational disruption at warehouses led some commentators to speculate about ransomware or destructive malware; that is not a confirmed technical finding. The confirmed response facts are that CEVA isolated affected systems, activated security protocols and brought in external investigators.","taken":"For Valve customers, the likely exposed fields were name, street address, phone number, email address, and hardware product type or order details. Other CEVA clients reported overlapping sets of delivery and customer-contact data. The exact total volume across all clients is unknown. Adding each company’s notification count would also risk double counting.","notTaken":"Valve said CEVA does not hold Steam payment information, passwords, Steam Guard codes or other Steam account credentials. CEVA told reporters that air, ocean, ground and rail operations continued and that the identified operational effect was limited to eight warehouses.","impact":"The breach creates two layers of risk. Operationally, warehouse disruption can delay orders, returns and refunds. From a privacy perspective, stolen delivery context enables persuasive package scams: a criminal who knows a victim’s address and exact recent hardware purchase can plausibly demand a small customs payment, redelivery fee or account verification.","response":"CEVA activated security protocols, isolated affected systems and engaged external investigators. Downstream clients began notifying their customers and relevant data-protection authorities. Valve explicitly warned customers to expect fake messages and said it was pressing CEVA for a fuller account of what had been taken and how.","methodDisclosure":"undisclosed","revision":"The investigation remained ongoing at the 16 August research cutoff. Technical method, total number of affected people and final number of client organisations should be treated as provisional.","quotes":[{"text":"expect fake messages","original":"expect fake messages","originalLang":"en","attribution":"Valve customer notice, reported 10 August 2026","sourceId":"cevaVerge"},{"text":"Treat all of them as fake.","original":"Treat all of them as fake.","originalLang":"en","attribution":"Valve customer notice, reported 10 August 2026","sourceId":"cevaVerge"}]}},"source":{"id":"cevaTechcrunch","name":"TechCrunch — CEVA Logistics warehouse breach","url":"https://techcrunch.com/2026/08/10/a-data-breach-at-shipping-giant-ceva-logistics-is-rippling-across-banks-retailers-steam-gamers-and-beyond/","publisher":"TechCrunch","kind":"secondary","published":"2026-08-10"},"sources":[{"id":"cevaTechcrunch","name":"TechCrunch — CEVA Logistics warehouse breach","url":"https://techcrunch.com/2026/08/10/a-data-breach-at-shipping-giant-ceva-logistics-is-rippling-across-banks-retailers-steam-gamers-and-beyond/","publisher":"TechCrunch","kind":"secondary","published":"2026-08-10"},{"id":"cevaVerge","name":"The Verge — Steam hardware shipper breach","url":"https://www.theverge.com/games/977314/valve-steam-hardware-shipping-data-breach","publisher":"The Verge","kind":"secondary","published":"2026-08-10"},{"id":"cevaPcgamer","name":"PC Gamer — Valve notice on the CEVA shipping breach","url":"https://www.pcgamer.com/gaming-industry/steam-user-data-may-have-been-compromised-by-a-cyberattack-targeting-valves-european-shipping-partner/","publisher":"PC Gamer","kind":"secondary","published":"2026-08-10"},{"id":"cevaComputing","name":"Computing — CEVA Logistics hack across Europe","url":"https://www.computing.co.uk/news/2026/security/ceva-logistics-hack-affects-firms-across-europe","publisher":"Computing","kind":"secondary","published":"2026-08-12"},{"id":"ceva","name":"TechRadar — CEVA Logistics knock-on effects","url":"https://www.techradar.com/pro/security/the-ceva-logistics-data-breach-is-having-major-knock-on-effects-across-europe-heres-what-we-know","publisher":"TechRadar","kind":"secondary","published":"2026-08-11"}]}