Ceva Logistics faces $5M lawsuit over employee data breach

Ceva Logistics, one of the world's largest third-party logistics providers with $18.3 billion in annual revenue, faces significant legal and operational challenges following a major data breach that compromised employee personal information including social security numbers and bank account details. A former employee has filed a class action lawsuit seeking at least $5 million in damages, alleging the company failed to implement adequate cybersecurity measures despite a prior incident in September 2025. The breach, which occurred in late July and involved the CoinbaseCartel ransomware group, disrupted operations across eight European warehouses serving retail and e-commerce customers in the Netherlands and surrounding regions. The incident exposes a systemic vulnerability in enterprise cybersecurity governance within logistics networks.

The apparent departure of key IT leadership, Bryant Duke (VP of IT Infrastructure Americas) in November and Susanne Shustein (Global CIO) in March, suggests internal organizational strain. The parent company CMA CGM Group's reassignment of Ceva's former CEO to oversee enterprise-wide cyber transformation signals recognition that vulnerabilities extend beyond a single logistics entity, potentially affecting the broader supply chain ecosystem. The company's failure to formally notify affected employees and the subsequent fraudulent activity experienced by plaintiffs demonstrate operational gaps in incident response protocols. For supply chain professionals, this case underscores the critical need to conduct rigorous cybersecurity due diligence on third-party logistics partners.

The breach's impact on warehouse operations, combined with the emerging pattern of ransomware targeting logistics infrastructure and healthcare distribution networks (evidenced by concurrent attacks on McKesson and Boston Scientific), signals heightened risk across critical supply chain nodes. Organizations relying on Ceva or similar 3PL providers should evaluate their own incident response procedures, backup systems, and contractual protections for data security breaches.