A Global Logistics Giant Was Breached Yesterday — Here's How That Ends Up in Your Inbox

On 11 August 2026, global freight company Ceva Logistics suffered a cyberattack that disrupted operations across eight warehouses in Europe. The breach affected customers of Dutch e-commerce giant Bol, luxury department store De Bijenkorf, eyewear brand Ace & Tate, Ajax football club, and Steam's European hardware business. Customer data — names, email addresses, phone numbers, postal addresses, order numbers, and tracking details — was accessed and likely copied by the attackers.

This incident happened thousands of kilometres away. So why does it matter to an Auckland business?

Why Stolen Logistics Data Becomes Phishing Fuel

Most people imagine a cyberattack as the moment their files disappear or their screen turns red. But for attackers, the breach is often just the first step. The real value is in what they do next with the data they have collected.

When attackers steal logistics and e-commerce records, they gain contextual legitimacy. They now know your name, what you ordered, where it's going, and how to reach you. That context lets them craft a follow-up email that is nearly indistinguishable from a real message:

• Fake shipping delay notices asking you to click a link to reschedule delivery — with your real order number included.
• Invoice fraud disguised as updated payment details from a known supplier.
• Credential harvesting pages dressed as carrier login portals, triggered by an email referencing your real tracking number.
• Business Email Compromise (BEC) where attackers impersonate your logistics provider and request payment to a new account.

Traditional spam filters catch bulk, generic phishing. They struggle with targeted emails that reference real order details, use correct names, and arrive in low volumes from legitimate-looking domains. This is exactly the attack pattern that follows large data breaches.

How AI Is Making Phishing Harder to Spot

The same generative AI tools that help businesses write faster are being used by attackers to write better phishing emails. Microsoft's security research teams have documented a clear shift: AI-generated phishing is now grammatically correct, contextually relevant, and stylistically matched to the target industry. The era of broken-English phishing emails is over.

What's changed most is the intent layer. Previously a phishing email could be caught by looking for suspicious links, spoofed domains, or keyword patterns. Today's attacks often contain no suspicious links at all in the first message — they start a conversation, build trust over several exchanges, then move the fraud to a second email. This is particularly common in BEC, where an attacker pretends to be a supplier and spends days in legitimate-looking correspondence before requesting a payment update.

Microsoft's AI email models achieve 99.995% attacker intent detection accuracy — not by looking for bad links, but by understanding what the sender is trying to accomplish.

What Microsoft 365 Business Premium Now Includes

Microsoft has rolled out AI-powered email and collaboration protection to Microsoft 365 Business Premium — a capability previously available only in enterprise-tier Defender for Office 365 Plan 2. It is now included in Business Premium at no additional cost.

Instead of matching patterns, the system uses purpose-built Large Language Models trained on one of the largest email threat datasets in the world. The AI reads email the way a human would — understanding context, intent, and conversational flow — and classifies messages based on what the sender is trying to achieve, not just the words they used or the links they included.

• Intent-based detection — identifies BEC, payroll fraud, invoice scams, and credential theft by understanding the goal of the message.
• Text-only attack coverage — catches sophisticated attacks that contain no malicious links or attachments, where traditional filters fail.
• Conversation thread analysis — detects multi-step attacks by analysing the full thread context, not just individual messages.
• 140,000 BEC emails blocked daily — Microsoft's reported figure for LLM-based detections across the Business Premium customer base.

This protection runs automatically before email reaches the inbox. There is nothing for your staff to do differently.

Four Settings Every Business Premium Tenant Should Have Enabled

The AI protection is most effective when foundational security settings are correctly configured underneath it. These are the four areas Optimyze checks first when reviewing a Microsoft 365 Business Premium tenant:

• Safe Links rewrites all URLs in emails and checks them at click time, not just at delivery. A link that was clean when the email arrived but was later weaponised gets caught the moment a user clicks it.
• Safe Attachments detonates files in a sandboxed environment before delivering them. A Word document with a malicious macro never reaches the inbox.
• Anti-phishing with impersonation protection flags emails that impersonate your executives, your key suppliers, and specified high-value domains — including logistics partners.
• DMARC enforcement prevents attackers from sending emails that appear to come from your domain. Without it, anyone can spoof your address to your customers and suppliers.

None of these require additional licensing beyond Business Premium. All four are off or misconfigured by default in most tenants we assess.

What This Means for NZ Businesses

The Ceva breach is a reminder that your attack surface is not limited to your own systems. Every supplier, logistics partner, and platform that holds your data — or your customers' data — is a potential entry point. You cannot control their security posture. You can control how well your defences handle the follow-on attacks that breaches like this generate.

If your business uses Microsoft 365 Business Premium, the AI email protection is already available to you. The question is whether it is switched on and correctly configured. In our experience assessing Auckland businesses, most Business Premium tenants have the licence but not the protection — the features exist in the tenant but have not been enabled or tuned.

Optimyze runs a Microsoft 365 security configuration review as part of our onboarding process. We check all Defender settings against Microsoft's secure baseline, enable the protections that are not active, and configure the policies specific to your business — your executive names, your key suppliers, your domains. The review takes one business day.

You cannot stop a logistics company on the other side of the world from getting breached. You can make sure that when the follow-up phishing email arrives in your inbox, it does not get through.