Your supplier passed the risk assessment. Then it became ten companies’ data breach

CEVA Logistics suffered a cyberattack affecting part of its European contract-logistics operation. The consequences travelled far beyond CEVA.

At least eight warehouses were affected. Customers including Valve, ING, Bol, Ajax, Ace & Tate, and De Bijenkorf reported disruption or potential exposure of customer information connected to their logistics operations. By 10 August, the Dutch data protection authority had reportedly received breach notifications from ten organisations linked to the incident.

CEVA said it had activated security protocols and launched an investigation. For affected customers, operational impact still meant shipment delays, privacy notifications, and the possibility of convincing phishing attempts using stolen delivery information.

Most third-party risk programmes are built around an assessment: policies, certificates, risk score, periodic refresh. That can show whether controls existed when a supplier answered. It cannot show how a live incident will move through an interconnected operation.

This one event combined operational, data, customer, regulatory, concentration, and fraud risk. Those risks are often assessed by different teams. The supplier experiences them as one event.

A supplier does not need to receive the largest payment to be critical. It may hold the data needed to fulfil an order, operate a warehouse, connect to an enterprise system, or sit between the business and its customers.

For every important third party, procurement should know what stops if it becomes unavailable tomorrow; what company, employee, or customer data it holds; which business units and downstream services depend on it; and how quickly the organisation would know something had gone wrong.

Contracts for critical suppliers should cover notification speed, operational continuity, recovery evidence, forensic cooperation, data retention, subcontractor visibility, and customer communications. Those rights need an owner after signature.

A supplier can pass the questionnaire and still become your incident.

Sources: TechCrunch · The Register