Pokémon Center has begun notifying customers in the United Kingdom and Germany that their personal information was exposed after a cyberattack on CEVA Logistics, the third-party responsible for fulfilling Pokémon Center orders in both markets.
The incident has also led to the cancellation of a batch of pending orders, extending the impact of a data-security event into customer service and supply chain disruptions.
The retailer said its own website was not the source of the compromise. Instead, the exposure was traced to CEVA Logistics, which processes delivery information for retail clients.
Pokémon Center Data Breach
In breach-notification emails, Pokémon Center apologized for canceling recent orders due to an “unforeseen fulfillment issue” and then explained that CEVA had been the victim of a cyberattack. CEVA told Pokémon Center the activity began on July 30, 2026, affecting systems used in the fulfillment process.
Pokémon Center said unauthorized parties may have accessed customers’ full names, mailing addresses, phone numbers, email addresses, and details about the contents of their PokémonCenter.com orders.
The company said payment-card details were not involved because CEVA does not have access to that information. It also stated that other Pokémon Center account information was not affected.
While the absence of payment data limits one category of immediate financial fraud, the exposed information still presents a material risk.
Names, residential addresses, contact details, and product information can give attackers the context needed to produce highly credible phishing emails, delivery-themed text messages, or fraudulent refund notices.
A message referencing a real order or a customer’s expected merchandise could be more persuasive than a generic scam. Pokémon Center’s UK website currently warns that some orders may experience longer processing, dispatch, and delivery times.
Customers have nevertheless reported outright cancellations, rather than simple delays. The company has not publicly explained why the breach required cancellations for some orders, nor has it clarified how many shoppers were affected.
The Pokémon Center incident forms part of a larger cyberattack affecting CEVA Logistics, one of the world’s largest contract logistics and shipping providers.
CEVA reportedly confirmed that the intrusion likely began on July 29 and disrupted at least eight warehouses in Europe. After identifying the incident, the company activated security procedures and informed affected clients on August 1 that part of its European contract logistics operations had been affected.
CSN said the operational effects were contained to the eight affected sites and that no other global systems were affected.
However, reporting indicates that the incident may have exposed customer data associated with banks, retailers, and gaming companies, including the Steam parent company, Valve. Valve said passwords and payment credentials were not exposed because CEVA did not hold them.
Dutch data-protection authorities and other law-enforcement agencies are investigating. CEVA has not publicly disclosed the entry point, technical details, or attribution.
Pokémon Center shoppers should independently verify any delivery, refund, or account-related message through official channels. Customers should avoid links in unexpected messages that claim urgent action is required.
The event illustrates how a compromise at a logistics supplier can create a multi-brand data exposure and provide attackers with valuable material for targeted social engineering.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
