Bol and De Bijenkorf warn customers of possible data leak

Online retailer Bol and department store chain De Bijenkorf have emailed customers to warn that their personal details may have been exposed in a cyberattack on a logistics company both firms use.

Hackers may have gained access to systems at CEVA Logistics, which handles deliveries for both companies. Names, addresses, postcodes, and phone numbers are among the details that may have been taken, broadcaster NOS reported.

Bol said its own systems were not affected and that the incident involves orders from a single distribution centre. Neither company has said how many customers may be affected, and De Bijenkorf has commissioned an external investigation into the breach.

Bol said there is no indication that payment details, passwords, or login credentials were affected and has taken part of its range offline – products handled by the logistics company – cancelled some orders, and stopped exchanging data with the firm as a precaution.

De Bijenkorf blocked access to the systems involved and added further security measures. It says customers may face delays to orders, returns, and refunds, and that email addresses and product information may also have been taken. The chain said it was certain no bank account numbers or passwords had been exposed.

CEVA told Bol about the possible breach on August 1 and the Dutch data protection authority AP was informed on August 3, but customers were only emailed on Wednesday.

A Bol spokesperson told NOS the company wanted to establish first what had happened and who was affected, rather than contacting people repeatedly.