Cybersecurity for the Logistics sector

2026

In 2026, Ceva Logistics, one of the world's largest shipping and logistics companies, was hacked. Operations at eight of its warehouses in Europe were reportedly disrupted over a weekend, delaying shipments for retail customers whose inventory was stored there. Several client companies said their own personal information was also stolen. Affected companies reportedly include Dutch e-commerce company Bol, department store De Bijenkorf, eyewear company Ace & Tate, football club Ajax and Steam's hardware business in Europe. Ceva operates eight e-commerce locations in the Netherlands and names Bol, Zalando and De Bijenkorf among the customers it serves there.

Bol said unauthorized parties gained access to two systems used to process orders from one of its distribution centers, that none of its own systems were affected, and that customer data processed there may have been accessed or copied. Potentially exposed data includes names, addresses, phone numbers, email addresses, order numbers, tracking information and purchase details. The Dutch data protection authority received breach reports from 10 organizations in relation to the incident. There is no public attribution, and it remains unclear whether ransomware was deployed or an extortion demand was made.[16][17][18]

2026

In 2026, Ahold Delhaize, the group behind Dutch supermarket chain Albert Heijn, detected suspicious activity in its IT infrastructure, brought in cybersecurity experts, and confirmed that the activity resulted from malicious actions by others. The company's response affected most of its brands across Europe and the United States, to varying degrees, although stores stayed open throughout. Industry experts estimate the incident cost Albert Heijn at least €10 million.

The company notified the Dutch National Cyber Security Centre (NCSC) within 24 hours of discovering the activity and kept the NCSC, law enforcement and other authorities updated. In its update of October 19, it did not identify those responsible or disclose technical details, so the attacker and the method remain unknown. [19][20]

2024-2026

Dutch haulage and logistics providers have faced a steady run of ransomware. Road haulier AB Texel was hit by a ransomware attack on February 16, 2024. The company said service and operations continued, started a recovery operation immediately, filed a police report and notified the Dutch Data Protection Authority. On November 15, 2024, Klarenbeek Transport discovered it had been attacked by the BlackSuit group, which stole essential data and encrypted key files, threatening business operations and customer data. Six days later, on November 21, 2024, the logistics systems of Jumbo and Hema, which run on Blue Yonder software, were hit by ransomware. Backup systems absorbed the blow, and the software was temporarily taken out of service. [21][1]

2023

In 2023, Royal Dirkzwager, a Dutch maritime logistics company founded in 1872, was hit by ransomware from the Play group. The company provides information to more than 800 maritime organizations and registers more than 200,000 ship movements a year, and its systems tell ports when ships will arrive and which nautical services will be available. The attackers leaked a 5 GB archive as proof and threatened to publish the full data set if the ransom was not paid. The Dutch Data Protection Authority was notified, and the company said it was negotiating with the criminals. Systems were running again six days later, but the cleanup took far longer, despite the negotiations. [22][23][5]

2023

In 2023, pro-Russian hackers knocked the websites of several Dutch ports offline for hours to days. The port companies of Eemshaven and Delfzijl, Amsterdam, Rotterdam and Den Helder confirmed they were hit by DDoS attacks. The Port of Rotterdam said the damage did not go beyond its website and that shipping systems were not affected. The group NoName057(16), which mostly uses a DDoS toolkit called DDoSia, hinted that the attacks were a response to the Dutch plan to buy Swiss tanks for Ukraine.

The group's members often target banks, private companies supplying the defense industry and logistics companies in NATO member states. In a separate law-enforcement action on July 15, a botnet of hundreds of computer systems worldwide was shut down and seven arrest warrants were issued, including against the main instigators living in the Russian Federation. [15][24][25]

2022-2026

For more than two years, Russia's GRU military unit 26165, known as APT28 or Fancy Bear, ran an espionage-oriented campaign against Western logistics providers and technology companies, including those involved in coordinating, transporting and delivering aid to Ukraine. The unit widened its targeting of these companies as Russian forces missed their military objectives and Western countries supported Ukraine's defense. Dozens of government and commercial entities were targeted across air, sea and rail. The actors used known techniques: password spraying, spearphishing and changes to Microsoft Exchange mailbox permissions. Once inside, they pursued accounts holding sensitive shipment information such as train schedules and shipping manifests, and then followed up on other transport companies with business ties to the first victim, exploiting those trust relationships.

The campaign is likely connected to wide-scale targeting of IP cameras in Ukraine and bordering NATO countries. The actors likely used access to private cameras near border crossings, military installations and rail stations to track the movement of materials into Ukraine. The joint advisory that set out the campaign was co-sealed by the Dutch military intelligence service MIVD. [12]

2022

On January 29, 2022, a ransomware attack was discovered that had hit oil terminals in ports in the Netherlands, Belgium and the German port of Hamburg. Over the course of 2022, ransomware attacks on oil terminals in Belgium, Germany and the Netherlands forced fuel supplies to be rerouted, and some of these attacks have been linked to the BlackCat and Conti groups, which have ties to state sponsors. [26][14]

2021

In 2021, a ransomware attack on Bakker Logistiek, a provider of conditioned warehousing and transportation, caused a cheese shortage in Dutch supermarkets, notably at Albert Heijn, the largest supermarket chain in the Netherlands. Inside its warehouses, the company no longer knew where products were stored and could no longer plan its transports. The ransomware group behind the attack is unknown. The company speculated that the attackers got in through the Microsoft Exchange ProxyLogon vulnerabilities that had been reported shortly before.

The case became known in the Netherlands as the cheese hack. It shows how a single logistics provider can empty supermarket shelves, and that an organization can be well prepared and still be exposed when one of its supply chain partners is not. [27][28]