2026 De Bijenkorf — logistics-partner breach; names, contact details and order data at risk (Aug 5)

Company-confirmed third-party breach — De Bijenkorf, the Dutch premium department store chain owned by Selfridges Group, warned customers on August 5, 2026 of a possible data breach at one of its logistics partners. A spokesperson said the breach was officially detected on the morning of Monday, August 3. The retailer said it cannot rule out that names, contact details and online-order data fell into the wrong hands, but that no payment details, bank account numbers or passwords were involved, and that it notified the Dutch Data Protection Authority as a precaution. De Bijenkorf kept the partner name confidential, clarifying only that the vendor handles logistics broadly and is not a parcel delivery service such as PostNL or DHL; Bol named the same class of partner — CEVA Logistics — when it disclosed a parallel breach the following day, which reporting treated as the likely common vendor. Because the partner completely shut down specific data systems to isolate the threat, De Bijenkorf reported delays in processing orders, returns and refunds, while stores and the webshop stayed open. Investigation into whether data was actually taken and at what scale was ongoing at indexing time, so recordsAffected is 0. On August 6 RTL Nieuws reported that De Bijenkorf and Bol customer data was for sale on the dark web.