Customer data from Bol.com and de Bijenkorf may have been stolen after hackers managed to break into a logistics partner of the webshops.
Online retailer Bol.com is warning customers about a data breach. Consumer data may have been compromised after hackers were able to break into a logistics partner of the online marketplace. The partner in question, CEVA Logistics, also works with de Bijenkorf, which is likewise warning its customers. Bol has temporarily suspended data exchange.
The hack at CEVA Logistics took place as early as August 1. The Dutch Data Protection Authority was informed on August 3. Bol communicated about the incident on August 5. The scope and cause of the hack are currently still being investigated.
The two stores note that the breach did not take place in their own systems. Only the partner performing logistics activities in one distribution center was targeted. Specifically, CEVA is responsible for a Bol distribution center in Waalwijk, the Netherlands. For customers, this is not such a relevant distinction: they entrusted their data to Bol (or de Bijenkorf) and are now seeing it leaked.
Partner as the weak link
Such attacks on logistics chains are no exception. Attackers prey on useful data and break in where security is weakest. It is no coincidence that the NIS2 regulations explicitly instruct the companies covered by them to verify the security level of their suppliers.
The fact that a company becomes the victim of a cyberattack does not automatically mean that its security was not in order.
Bol.com
Bol notes that it does indeed set high standards for the parties it works with, including regarding information security. According to the webshop, CEVA Logistics is an internationally renowned party. Bol is maintaining its trust for the time being. “The fact that a company becomes the victim of a cyberattack does not automatically mean that its security was not in order. That is currently being investigated,” a statement reads.
Customers informed
The data that may have been leaked includes name, address, zip code, and phone number. Other data may also be subject to the attack, although payment details, passwords, or login data are said to be safe.
Bol has already informed part of its customer base by email, both in Belgium and the Netherlands. How broad the impact of the breach is is not entirely clear, although the impact remains limited to customers who have in one way or another received packages that passed through the affected distribution center. Those who have not received an email are likely not affected. The impact for de Bijenkorf is also not entirely clear. It also remains to be seen if and when stolen data will actually be shared.
Phishing wave in the making?
Although the stolen data is not extremely sensitive (hackers cannot log in anywhere with it), such a hack usually has noticeable consequences for consumers whose data appears on the dark web. Security researchers were able to map this out well after the major Odido hack in the Netherlands.
The main risk is a sharp increase in phishing, using stolen address data. Attackers can correlate data and thus send more convincing phishing emails. Although this does not always happen (most phishing emails remain fairly general), criminals do set up new campaigns very quickly after the stolen data is leaked.
Being alert to phishing is always important. Those who are victims of a hack like this one can expect even more malicious emails. Being too suspicious does no harm, but the opposite does.