Ceva Logistics sued over theft of employee records during data breach

The complaint alleges that the personal information of employees, including bank account details and social security numbers, was stolen during the cyber intrusion, which never would have happened had the company taken appropriate precautions following a similar incident a year earlier. 

The CoinbaseCartel initiated a ransomware attack on Ceva Logistics in September 2025, according to SOCRadar, a cyber intelligence platform. Ceva did not publicly disclose the incident. In November, Bryant Duke, Ceva’s vice president of IT infrastructure Americas announced his departure on LinkedIn. Susanne Shustein, global chief information officer, informed friends and colleagues on the social media site in March that she had left the company. The departure of two IT leaders so close together is unusual.

During the summer, parent company CMA CGM Group moved Mathieu Friedberg from CEO of Ceva to executive vice president of transformation and cyber at CMA CGM. The transfer to oversee cybersecurity implies the parent company believes the cyber threat is not isolated to Ceva Logistics and extends across the enterprise, said an a source inside the company who did not want to be identified because of concerns about retaliation.

“Cybercriminals were able to breach Defendant’s systems because Defendant failed to adequately train its employees on cybersecurity and failed to maintain reasonable security safeguards or protocols to protect the Class’s private information . . . rendering [employees] easy targets,” Krupa said in the claim.

The filing also claims Ceva has not formally notified employees about the breach, preventing them from trying to mitigate use of their personal information to commit fraud. 

Krupa said he experienced fraudulent activity on his credit card and was forced to cancel the card, and also suffered an increase  in spam and scam phone calls. 

The complaint asks the court to grant class action status, saying that at least 100 employees have been harmed and that the number of affected persons could extend into the thousands. 

The suit seeks at least $5 million in compensation and damages for Ceva’s alleged negligence, breach of implied contract, and unjust enrichment

“Instead of providing a reasonable level of security, or retention policies, that would have prevented the data breach, Defendant instead calculated to avoid its data security obligations at the expense of Plaintiff and Class Members by utilizing cheaper, ineffective security measures. Plaintiff and Class Members, on the other hand, suffered as a direct and proximate result of Defendant’s failure to provide the requisite security,” the filing said.

Healthcare sector attacked

In related news, pharmaceutical distribution giant McKesson Corp., last week confirmed in a government filing that it had discovered a cybersecurity incident affecting its information systems. In a statement on Friday, it said hackers broke into third-party data servers and removed sensitive customer data within two business units, and that the company expected “intermittent service degradation.” Employee data was also stolen. 

Tech site Bleeping Computer said the ShinyHunter hacker group is demanding $55 million in ransom to not publicly release the private data.

McKesson is the latest healthcare or medical device maker to be victimized this year by cyber criminals that extort companies into paying ransoms to keep data from being released. Boston Scientific was the target of a cyberattack last month that knocked much of its network offline.

Click here for more FreightWaves/American Shipper stories by Eric Kulisch.

Write to Eric Kulisch at ekulisch@freightwaves.com.

RELATED STORIES:

Cyberattack on Ceva Logistics warehouses in Europe impacts retailers

CMA CGM hires hires FedEx executive Moebel to lead Ceva Logistics

Ceva Logistics poised to acquire European final-mile courier Paack

Colis Privé expands last-mile delivery business into Spain and Portugal