Pokémon Center is informing customers in the United Kingdom and Germany that a third-party data breach has occurred after hackers stole customers’ personal information and order information from third-party logistics provider CEVA Logistics.
While CEVA’s systems were compromised in the cyberattack, the exposed records belonged to Pokémon Center customers who placed orders on the site. The company then shared this information with the logistics provider to fulfill and ship orders from PokemonCenter.com.
CEVA Logistics is a subsidiary of CMA CGM Group, the third largest shipping company in the world. The logistics service provider operates 1,000 warehouses, processed 15 million shipments last year and reported sales of $18.3 billion in 2025.
The company recently suffered a cyberattack where attackers breached its servers between July 29 and August 1. Several retailers in Europe are affected.
The CEVA breach also affected Valve, which informed Steam hardware customers in Europe that their names, addresses, phone numbers, email addresses and information about ordered products were stolen during the cyberattack.
The Valve breach notice states that CEVA stores delivery-related information for up to 90 days after an order. However, it is unclear whether the same retention period applies to Pokémon Center customer data.
The attack also destroyed eight of its European warehouses, causing delivery delays for many customers.
Pokémon Center orders canceled after violation
In data breach notification emails viewed by BleepingComputer, Pokémon Center states that CEVA is the carrier it uses to ship PokemonCenter.com products to customers in the United Kingdom and Germany.
“We are sorry to inform you that we had to cancel your last order (order number) due to an unforeseen fulfillment issue,” the Pokémon Center data breach notification reads.
“We are writing to inform you of a cyber incident involving a Pokémon Center logistics provider that may compromise some of your data. CEVA Logistics (“CEVA”), the provider Pokémon Center uses to ship PokemonCenter.com products to customers in the United Kingdom and Germany, has informed us that they have unfortunately been the victim of a cyberattack that began on July 30, 2026.”
According to Pokémon Center, unauthorized parties may have obtained customers’ full names, mailing addresses, phone numbers, email addresses and details about the contents of their PokemonCenter.com orders.
The company says other information related to customers and their orders will not be affected and that CEVA does not have access to customers’ payment card information.
The Pokémon Center is currently displaying a notice on its UK website advising that some orders are experiencing delays and processing, shipping and delivery may take longer than usual.
Source: BleepingComputer
However, customers also report that the breach resulted in their orders being canceled, although it is unclear why the cyberattack would require cancellations and not just delays.
While first reports warned of cancellations for the highly anticipated 30th anniversary collection products, a Reddit post shows that other merchandise, such as the Ghost Chateau Cyndaquil keychain, was affected.
Another customer replied that they also received the same cancellation email.
BleepingComputer contacted the Pokémon Center and Pokémon media contacts to learn more about the breach and why the incident resulted in customer orders being canceled, but did not receive a response.
Overall prevention scores can hide what happens after the first access. Once attackers use valid credentials, prevention drops sharply.
The 2026 Blue Report measures defense technology for technology in 338 million simulations conducted in customer production environments.
