De Bijenkorf warns customer data may be exposed after cyber incident at logistics partner

Logistics Partner Compromised

Dutch luxury department store chain De Bijenkorf announced a cyber incident impacting one of its external logistics partners. The retailer stated that its own infrastructure, including stores, website, and mobile app, remains operational and was not compromised. The logistics partner intervened immediately to block access and implement additional security measures.

Potential Data Exposure and Operational Delays

An investigation is underway to determine if customer information was accessed. Potentially exposed data includes names, email addresses, postal addresses, phone numbers, and details related to online purchases such as products, prices, discounts, delivery information, and payment methods. For business customers, company names and VAT numbers might also be affected. The logistics provider did not store payment card details, bank account numbers, usernames, or passwords, so these are not believed to be exposed. Customer accounts are also not considered at risk as no login credentials were involved.

The incident has caused delays in customer orders, returns, and refunds. While online orders can still be placed, deliveries are taking longer, and processing for returns and refunds is slower than usual.

Industry Trend of Supply Chain Attacks

This incident is part of a broader trend where cybercriminals target retail and food companies indirectly by compromising their suppliers and service providers. De Bijenkorf has notified potentially affected customers and reported the incident to the Dutch data protection authority as a precautionary measure. The company did not disclose whether the incident involved ransomware or a ransom demand, and no threat actor has publicly claimed responsibility.