Pokémon Center is notifying customers in the United Kingdom and Germany about a third-party data breach after hackers stole personal and order information from CEVA Logistics, the company’s shipping provider.
CEVA’s systems were compromised in a cyberattack, exposing information belonging to Pokémon Center customers who placed orders through PokémonCenter.com. Pokémon Center shared the data with logistics providers so they could process and deliver customer orders.
CEVA Logistics is a subsidiary of CMA CGM Group, the world’s third-largest shipping company. The logistics provider operates approximately 1,000 warehouses, processed 15 million shipments last year, and reported $18.3 billion in revenue in 2025.
CEVA recently suffered a cyberattack in which an attacker infiltrated its servers between July 29 and August 1, 2026. The incident affected multiple retailers in Europe.
The CEVA breach also affected Valve. The company notified European Steam hardware customers that their names, addresses, phone numbers, email addresses, and information about ordered products were exposed in the cyberattack.
Valve’s breach notification states that CEVA retains shipping-related information for up to 90 days after an order is placed. However, it remains unclear whether the same retention period applies to Pokémon Center customer data.
The cyberattack also reportedly disrupted operations at eight warehouses in Europe, causing delivery delays for many customers.
Pokémon Center cancels orders after CEVA data breach
In a data breach notification email seen by BleepingComputer, Pokémon Center said it uses CEVA to ship PokémonCenter.com products to customers in the United Kingdom and Germany.
“We are sorry to inform you that we have had to cancel your recent order,” followed by the order number, “due to unexpected fulfillment issues,” the Pokémon Center notification states.
“We would like to inform you of a cyber incident that has affected Pokémon Center’s logistics provider and may affect some of your information. CEVA Logistics (“CEVA”), a vendor used by Pokémon Center to ship items from PokémonCenter.com to customers in the United Kingdom and Germany, has unfortunately informed us that it is the victim of a cyberattack that began on July 30, 2026.”
Pokémon Center said an unauthorized third party may have obtained customers’ names, addresses, phone numbers, email addresses, and details about orders placed through PokémonCenter.com.
The company said other customer and order information was not affected. It also confirmed that CEVA does not have access to customers’ payment card details.
Pokémon Center is currently displaying a notice on its UK website warning that some orders have been delayed and may take longer than usual to process, dispatch, and deliver.
Source: BleepingComputer
It is unclear why the cyberattack required some orders to be canceled instead of simply delayed. However, customers have reported that their orders were canceled following the breach.
Meanwhile, an initial report warned that orders for highly anticipated 30th-anniversary collection products had been canceled. Other products, including the Ghost Chateau Cyndaquil keychain, were also reportedly affected, according to a Reddit post.
Another customer also reported receiving the same order cancellation email.
BleepingComputer contacted Pokémon Center and Pokémon media representatives for more information about the data breach and the reasons behind the canceled orders, but had not received a response at the time of publication.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses can drop sharply.
Blue Report 2026 measures defense techniques by technology across 338 million simulations conducted in customer production environments.
Source: www.bleepingcomputer.com