News reaction: CEVA Logistics cyber attack

Following reports of a cyberattack on CEVA Logistics that has disrupted warehouse operations across Europe and impacted customers of multiple organisations, Gary Cannon, Global Transport Lead at NCC Group, discusses what the incident reveals about growing supply chain cyber risk and why organisations must rethink resilience across their wider partner ecosystem. 

1. What's most noteworthy about this incident and why? 

The most noteworthy aspect of this incident is that it demonstrates how a cyber attack against a single logistics provider can quickly become a multi-sector supply chain event. Although the intrusion appears to have affected a limited number of warehouses, the consequences have cascaded across retailers, financial organisations, consumer brands and their customers, resulting in both operational disruption and the exposure of personal information.  

What makes logistics providers particularly attractive targets is their position at the centre of large and complex supply chains. They connect manufacturers, retailers, carriers and end customers, occupying a uniquely sensitive role in the movement of goods and services. As a result, when their operations are disrupted, the effects can quickly extend beyond technology systems into inventory management, customer fulfilment and service continuity. Logistics providers also hold sensitive customer data, making them valuable targets for cybercriminals. Attackers do not need to compromise dozens of organisations individually when breaching a single trusted supplier can create widespread disruption and impact across the supply chain.  

2. How big is its impact in the bigger picture? 

The immediate impact appears to extend beyond CEVA itself, affecting multiple organisations and potentially large numbers of customers whose personal information may have been exposed. Several companies have also reported shipping disruptions and delays, highlighting how cyber incidents can increasingly affect real-world operations as well as digital systems.  

In the bigger picture, this incident serves as another reminder that supply chain compromises often have a much larger blast radius than initially expected. NCC Group research has previously highlighted that organisations can be heavily affected by attacks against suppliers, even when their own networks remain uncompromised. The consequences can range from lost productivity and delayed services to reputational damage and reduced customer trust.  

3. What bigger cybersecurity issues does it call attention to? 

This incident highlights three important challenges. 

First, it exposes the growing risk associated with third-party and supply chain dependencies. Many organisations rely on logistics providers, cloud services and software vendors but have limited visibility into how those organisations manage cyber risk. NCC Group's research has previously described supply chains as a potential "blind spot" for cyber security, where organisations often place significant trust in partners without having meaningful oversight of their security posture.  

Second, it demonstrates how digital attacks can have physical consequences. When attacks disrupt warehousing, fulfilment or transportation systems, the effects can be felt well beyond the IT department, impacting customers, operations and revenue. As logistics operations become more digitised and interconnected, the potential impact of disruption continues to increase.  

Finally, the theft of customer contact information creates opportunities for follow-on phishing and social engineering attacks. Criminals can use legitimate shipping information to make fraudulent messages appear much more convincing, increasing the risk to affected individuals long after the initial breach.  

4. What can be done to prevent similar incidents in the future? 

While no organisation can eliminate cyber risk entirely, businesses can significantly reduce their exposure by treating supply chain security as a core element of organisational resilience rather than a compliance exercise. 

Organisations should conduct continuous monitoring and assessment of critical suppliers, ensure contractual security requirements are in place, and regularly test their ability to operate during a supplier outage. Visibility across the supply chain is essential, particularly where third parties handle sensitive customer data or support critical operational processes.  

For logistics operators specifically, maintaining strong segregation between critical operational systems and corporate IT environments, improving asset visibility, and investing in detection and response capabilities can help reduce the likelihood that a compromise turns into widespread operational disruption.  

5. Do you have anything more to add? 

Perhaps the most important lesson from this incident is that cyber resilience is no longer solely about protecting your own organisation. Businesses are increasingly connected through complex digital ecosystems, meaning an attack against a supplier can quickly become your problem as well. 

Events like this should prompt organisations to ask difficult questions about their dependence on third parties: what access suppliers have to sensitive data, how disruptions would affect operations, and whether contingency plans are in place if a critical partner suddenly becomes unavailable. The key question for organisations now is not whether they use CEVA, but whether they have comparable dependencies elsewhere in their supply chain. The most resilient businesses will use incidents like this as an opportunity to identify critical third-party risks, validate contingency plans and ensure they can continue operating even when a trusted supplier experiences a significant cyber event.