On 1 August, a warehousing partner that works with bol informed us of a security incident affecting its systems. Based on the partner’s investigation, unauthorized parties may have gained access to systems and data used to process orders from one of bol’s distribution centres.

The warehousing partner immediately implemented measures to prevent further unauthorized access. In addition, cybersecurity specialists were engaged to investigate the cause and extent of the incident.

No bol systems were affected. At this stage, the incident appears to be limited to two systems operated by this partner.

Because unauthorized parties may have had access to customers’ personal data, we are treating this incident as a data breach. For that reason, we have reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and are directly informing customers whose data may have been involved.

The data potentially involved consists of information required to process and deliver an order. This may include a customer’s name, address details, email address, phone number, order number, EAN, track & trace information, and order details.

This does not involve all customer data held by bol. Only data stored in the affected systems of the warehousing partner may be impacted.

If your data may have been involved in the incident, you will have received an email from bol informing you about it. At the bottom of the email, you can find the order concerned. This order, along with the associated personal data, was present in the affected systems at the time of the security incident and could therefore have been involved.

You can view this personal data yourself in your bol account. This includes the name and email address you use with bol. In your bol account, under My bol > Orders > Order details, you can see which data is involved: your telephone number (if applicable to this order), order number, EAN, track-and-trace information, and the delivery address associated with that specific order.

No, no bank account numbers, payment details, or passwords were accessed. The warehousing partner does not hold this information.

We cannot yet provide final numbers. Customers whose data may have been involved have been informed directly.

We maintain high standards for all parties we work with, including requirements related to information security. Unfortunately, cyberattacks can occur despite extensive security measures.

Our current focus is on minimizing the impact of this incident and carefully investigating its cause and consequences.

It is too early to determine that. The investigation into the cause of the incident is still ongoing. Once we have more clarity, we will carefully review the findings and take any additional measures that may be necessary.

Our warehousing partner is an international logistics service provider that supports logistics operations for many organizations.

Unfortunately, cybercrime remains a risk for organizations worldwide. The fact that a company becomes the victim of a cyberattack does not automatically mean that its security measures were inadequate. This is currently being investigated.

We first established the facts and investigated which customers may have been affected. Once sufficient information was available to accurately notify the affected customers, we did so. The affected customers were informed on 5 August. In addition, we notified the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) of the incident on 3 August.

For some customers, the incident may affect both their order and their personal data.

Orders processed through the affected location may experience delays or have been cancelled. In addition, personal data required for processing and delivering orders may have been viewed or copied by unauthorized parties.

For this reason, we have informed affected customers directly and advise them to remain alert to phishing attempts and other types of fraud. At this time, there is no indication that payment information, passwords, or bol customer login credentials were affected, and there is no evidence to suggest that customers need to take any direct action.

We recommend that customers remain alert to phishing attempts and other forms of fraud. Always check the sender of messages carefully, do not click on links from unexpected emails, and never share personal information if you are asked to do so unexpectedly.

At this time, we have no indication that the potentially affected data has actually been misused, and there are no indications that customers need to take any immediate action.

We believe it is important to be transparent. If there is a possibility that personal data has been viewed or copied, we believe customers should be made aware so that they can take appropriate precautions and remain alert to possible misuse.

Yes. Because personal data of bol customers may have been involved, bol has reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Yes. Our website, app, and all other logistics locations remain operational. No bol systems were affected by this incident.

We continue to monitor the situation closely and are taking additional precautionary measures where necessary.

Should the situation change and warrant further communication with affected individuals, we will, of course, inform them as soon as possible. This FAQ will also be updated on an ongoing basis to reflect the latest developments.

You can easily manage this yourself through your customer account under “Data & Preferences” > “Exercise Privacy Rights.”

Please also refer to the question: “Which data may have been accessed?”

If you have questions about the status of your order and/or pre-order, please contact our Customer Service team at 030 - 310 4999 (NL) or +32 (0) 27 885 999 (BE), or send an email to klantenservice@bol.com.

Payments are entirely unrelated to the security incident. You can continue to make payments securely and safely.

The security incident that occurred is unrelated to your account and its security. No passwords, bank account numbers, or payment details were accessed. That said, we understand that the security of your account is important to you and that you may want to take additional measures to protect it. One option is to enable two-factor authentication (2FA). This adds a second layer of security in addition to your password, such as a security key on your smartphone, a fingerprint, or facial recognition.

To date, we have found no indications that data is being offered on the dark web. We continue to actively monitor the situation.

The email address is used to generate a Track & Trace (shipping) code. The phone number is only shared when a delivery appointment needs to be scheduled.