On 1 August, a warehousing partner that works with bol informed us of a security incident affecting its systems. Based on the partner’s investigation, unauthorized parties may have gained access to systems and data used to process orders from one of bol’s distribution centres.

The warehousing partner immediately implemented measures to prevent further unauthorized access. In addition, cybersecurity specialists were engaged to investigate the cause and extent of the incident.

No bol systems were affected. At this stage, the incident appears to be limited to two systems operated by this partner.

Because unauthorized parties may have had access to customers’ personal data, we are treating this incident as a data breach. For that reason, we have reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and are directly informing customers whose data may have been involved.

The data potentially involved consists of information required to process and deliver an order. This may include a customer’s name, address details, email address, phone number, order number, EAN, track & trace information, and order details.

This does not involve all customer data held by bol. Only data stored in the affected systems of the warehousing partner may be impacted.

If your data may have been involved in the incident, you will have received an email from bol informing you about it. At the bottom of the email, you can find the order concerned. This order, along with the associated personal data, was present in the affected systems at the time of the security incident and could therefore have been involved.

You can view this personal data yourself in your bol account. This includes the name and email address you use with bol. In your bol account, under My bol > Orders > Order details, you can see which data is involved: your telephone number (if applicable to this order), order number, EAN, track-and-trace information, and the delivery address associated with that specific order.

EAN data refers to the information associated with an EAN code (European Article Number). An EAN is a unique identification code for a product, usually the 13-digit number found beneath a barcode on a product's packaging.

bol processes and shares personal data with the warehousing partner to the extent necessary to fulfil the agreement with you, namely to process, ship and deliver your order. bol only shares the personal data that is necessary for this logistics service. Contractual agreements are in place with the logistics warehousing partner regarding the processing and security of personal data.

No, no bank account numbers, payment details, or passwords were accessed. The warehousing partner does not hold this information.

We cannot yet provide final numbers. Customers whose data may have been involved have been informed directly.

We maintain high standards for all parties we work with, including requirements related to information security. Unfortunately, cyberattacks can occur despite extensive security measures.

Our current focus is on minimizing the impact of this incident and carefully investigating its cause and consequences.

It is too early to determine that. The investigation into the cause of the incident is still ongoing. Once we have more clarity, we will carefully review the findings and take any additional measures that may be necessary.

Our warehousing partner is an international logistics service provider that supports logistics operations for many organizations.

Unfortunately, cybercrime remains a risk for organizations worldwide. The fact that a company becomes the victim of a cyberattack does not automatically mean that its security measures were inadequate. This is currently being investigated.

We first established the facts and investigated which customers may have been affected. Once sufficient information was available to accurately notify the affected customers, we did so. The affected customers were informed on 5 August. In addition, we notified the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) of the incident on 3 August.

For some customers, the incident may affect both their order and their personal data.

Orders processed through the affected location may experience delays or have been cancelled. In addition, personal data required for processing and delivering orders may have been viewed or copied by unauthorized parties.

For this reason, we have informed affected customers directly and advise them to remain alert to phishing attempts and other types of fraud. At this time, there is no indication that payment information, passwords, or bol customer login credentials were affected, and there is no evidence to suggest that customers need to take any direct action.

We recommend that customers remain alert to phishing attempts and other forms of fraud. Always check the sender of messages carefully, do not click on links from unexpected emails, and never share personal information if you are asked to do so unexpectedly.

At this time, we have no indication that the potentially affected data has actually been misused, and there are no indications that customers need to take any immediate action.

We believe it is important to be transparent. If there is a possibility that personal data has been viewed or copied, we believe customers should be made aware so that they can take appropriate precautions and remain alert to possible misuse.

Yes. Because personal data of bol customers may have been involved, bol has reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Yes. Our website, app, and all other logistics locations remain operational. No bol systems were affected by this incident.

We continue to monitor the situation closely and are taking additional precautionary measures where necessary.

Should the situation change and warrant further communication with affected individuals, we will, of course, inform them as soon as possible. This FAQ will also be updated on an ongoing basis to reflect the latest developments.

You can easily manage this yourself through your customer account under “Data & Preferences” > “Exercise Privacy Rights.”

Please also refer to the question: “Which data may have been accessed?”

If you have questions about the status of your order and/or pre-order, please contact our Customer Service team at 030 - 310 4999 (NL) or +32 (0) 27 885 999 (BE), or send an email to klantenservice@bol.com.

Payments are entirely unrelated to the security incident. You can continue to make payments securely and safely.

The security incident that occurred is unrelated to your account and its security. No passwords, bank account numbers, or payment details were accessed. That said, we understand that the security of your account is important to you and that you may want to take additional measures to protect it. One option is to enable two-factor authentication (2FA). This adds a second layer of security in addition to your password, such as a security key on your smartphone, a fingerprint, or facial recognition.

To date, we have found no indications that data is being offered on the dark web. We continue to actively monitor the situation.

The email address is used to generate a Track & Trace (shipping) code. The phone number is only shared when a delivery appointment needs to be scheduled.

During the ongoing investigation, additional findings have come to light. These findings showed that more customers may have been affected by the incident than could previously be determined. As soon as we had sufficient certainty about this, we informed those customers directly.

The earlier communication was based on the information that was available and validated at that time. The investigation into the incident is still ongoing. In an investigation of this scale, new insights can emerge over time. We believe it is important to be transparent and to inform affected customers as soon as information has been verified.

Determining exactly which data was involved in a security incident is a complex process. It involves examining and validating large volumes of data. While we want to inform customers as quickly as possible, we also want to avoid sharing incomplete or inaccurate information.

Additional investigation has shown that more orders may have been affected by the incident than was previously known. As a result, these customers are receiving an update with the most current information available.

In some cases, personal data was found in the affected systems, but it is not currently possible to link that data to a specific order. As a precaution, we are also informing these customers.

The data stored in the affected systems varied by customer and by order. As a result, the types of personal data that may have been involved also vary. A phone number is only involved if a delivery appointment was arranged for an order.

The investigation is still ongoing. We believe it is important to be transparent and to inform affected customers as soon as information has been verified. If new relevant findings emerge, we will also inform any additional customers who may be affected.

We do not share numbers. All customers who have been identified as potentially affected are being informed directly.

The investigation into the security incident is still ongoing. We are currently examining exactly which data was present in the affected systems and the period of time it may relate to. Therefore, we cannot yet definitively determine how far back potentially affected data may date. Despite this uncertainty, we wanted to inform you that your data may have been involved in this incident.

No. In fact, a thorough investigation often uncovers new findings over time. With security incidents, it is not unusual for the full scope to become clear only as the investigation progresses. We choose to inform customers as soon as new findings have been sufficiently confirmed.

We are working closely with CEVA and external specialists to investigate the impact of the incident. In addition, we are informing affected customers directly, providing them with practical information and advice, and continuing to monitor any new developments.

Certain personal data must be shared with logistics partners in order to process and deliver orders. This is subject to contractual agreements and security measures designed to protect personal data. Despite these safeguards, a security incident occurred at CEVA.

In an investigation of this scale, new findings can emerge over time. We believe it is important to be transparent and have deliberately chosen to inform affected customers as soon as new findings have been verified. The investigation is being carried out carefully, and if it shows that additional customers may be affected, we will inform them directly. That is what we are doing now. We believe transparency is more important than waiting until every detail has been conclusively established.