A single compromised logistics vendor has now generated a dozen separate breach notifications to the Dutch data protection authority — and the regulator isn't saying who filed them.
What happened
Between July 29 and August 1, 2026, unauthorized parties accessed systems inside CEVA Logistics, the global freight and fulfillment company that handles last-mile order processing for a long list of Dutch brands. CEVA has confirmed a security incident but has not detailed how attackers got in (The Record reports the intrusion touched systems across eight European warehouses). The exposure was not payment data or passwords — CEVA doesn't hold those — but the connective tissue of e-commerce: names, addresses, postal codes, phone numbers, email addresses and order details, and for business accounts, VAT numbers.
Because CEVA sits underneath dozens of client brands as a processor, the blast radius fanned out fast. Online retailer Bol confirmed it was notified of the incident on August 1 and that an affected distribution center was briefly taken offline, causing delivery delays (iamexpat.nl). Department store De Bijenkorf, eyewear retailer Ace & Tate, football club Ajax, and Steam hardware seller Valve all separately disclosed exposure (helpnetsecurity.com). Zalando says it was touched by the incident but that customer data was not affected.
Twelve filings, five names, one silence
Under Article 33 of the GDPR, a controller that becomes aware of a personal data breach must notify its national supervisory authority "without undue delay and, where feasible, not later than 72 hours" after discovery (EUR-Lex, Regulation (EU) 2016/679). Because each CEVA client is a separate controller for its own customer relationship, each one owes its own notification — which is why one processor incident has produced twelve distinct filings with the Autoriteit Persoonsgegevens (AP), not one. Dutch outlet Welingelichte Kringen reports the AP has confirmed receiving twelve notifications tied to the CEVA incident, of which only five companies — Bol, De Bijenkorf, Zalando, Ace & Tate and Ajax — have been named. Asked to identify the remaining seven, the regulator declined: "Om welke bedrijven het gaat wil de toezichthouder niet zeggen" — the supervisor will not say which companies are involved (welingelichtekringen.nl).
That reticence is defensible on its own terms, and it deserves a fair hearing before criticism. Article 33 notifications are confidential regulatory filings, not public disclosures — the GDPR's separate, narrower obligation to notify affected individuals directly (Article 34) is the mechanism meant to reach consumers, and it applies only when the breach poses a "high risk." Naming companies mid-investigation could also prejudice the AP's own fact-finding, invite copycat social-engineering attacks against firms known to be scrambling, or unfairly stigmatize a company whose only fault was choosing a fulfillment vendor that later got breached. Regulators routinely withhold names during active supervision for exactly these reasons, everywhere from financial-conduct authorities to health inspectors.
Where the steelman runs out
But the CEVA case strains that logic. This isn't a single quiet incident where confidentiality protects an ongoing probe — it's already a public, widely reported breach with five companies self-identified and customer data reportedly circulating on dark-web marketplaces. Withholding the other seven names doesn't protect an investigation so much as it deprives customers of the one piece of information that would let them act: whether their own vendor was among the twelve. A consumer who ordered from an unnamed sixth or seventh retailer has no way to know their data may be exposed unless that retailer volunteers the fact — and Article 34's "high risk" threshold gives companies real discretion to conclude it doesn't apply to them.
This is also the wrong moment for Dutch regulators to look thin on transparency. The Cyberbeveiligingswet, the Netherlands' implementation of the EU's NIS2 directive, entered into force on August 15, 2026, extending cybersecurity and incident-reporting obligations to roughly 8,000 organizations across 18 sectors, transport included (Rijksoverheid.nl). The pitch behind that law was a more legible, more accountable incident-reporting regime for exactly this kind of fourth-party supply-chain failure. A logistics breach cascading through a dozen brands within days of that law taking effect is the first real test of whether "more reporting" also means "more clarity" — and so far the AP's answer is that it means more paperwork, not more sunlight.
The proportionate fix
None of this argues for weakening Article 33 or piling new breach-disclosure mandates onto controllers who are themselves victims of a vendor's failure — that would punish companies for CEVA's security lapse and chill honest self-reporting. The better fix is narrower: the AP should publish an aggregate, anonymized breach-scope figure (a count and sector list) faster than it currently does, and Dutch companies relying on shared logistics processors should treat vendor security audits, not just contractual indemnities, as a compliance baseline. Confidential supervision and public accountability aren't in tension here — they just require the AP to say slightly more than "trust us" while an active breach is still being sold on the dark web.