Pokémon Center Data Breach Exposes Customers’ Personal and Order Data

Pokémon Center has begun notifying customers in the United Kingdom and Germany that personal information from their online orders was exposed following a cyberattack on CEVA Logistics, its third-party fulfillment partner.

The retailer clarified that the incident did not originate from Pokémon Center’s own systems or website. Instead, attackers compromised the systems CEVA uses to process delivery information for retail customers, exposing data associated with orders placed on PokémonCenter.com. As a result, Pokémon Center was forced to cancel an undisclosed number of pending orders.

Pokémon Center Data Breach

In notifications sent to affected customers, Pokémon Center apologized for the recent cancellations, describing them as arising from an “unforeseen fulfillment issue.”

The company later clarified that the disruption was linked to the cyberattack on CEVA Logistics, which reportedly began on July 30, 2026. CEVA’s compromised systems contained delivery-processing information necessary for fulfillment operations in the UK and Germany.

Pokémon Center stated that its logistics partner informed it that customer data had been affected by the broader incident.

The potentially affected records include customers’ full names, postal addresses, telephone numbers, email addresses, and details about their Pokémon Center orders.

While Pokémon Center emphasized that payment card data was not compromised, the exposed information could still be valuable to fraudsters.

CEVA reportedly does not process or store customers’ card details, and Pokémon Center has asserted that other account information was not impacted.

However, attackers could utilize legitimate order details, merchandise descriptions, and delivery addresses to create convincing phishing campaigns, fraudulent refund requests, or courier-themed text-message scams.

Pokémon Center’s UK website has displayed an advisory warning customers about delays in processing, dispatch, and delivery of some orders. However, several customers have reported full cancellations instead of routine fulfillment delays.

According to CSN, the company has not explained why certain affected purchases could not be processed after the breach, whether the decision to cancel orders was related to warehouse operations, or how many orders were impacted.

Customers are advised to independently verify any alleged shipment updates, replacement requests, refund notifications, or delivery-fee demands through the official Pokémon Center website, rather than clicking on links in unsolicited messages.

This exposure appears to be part of a broader incident at CEVA Logistics that is affecting European contract logistics operations. CEVA informed customers on August 1 that a cyber intrusion had disrupted parts of its European business and affected at least 8 warehouses.

The company stated that the operational impact was contained to those sites and that its other global systems remained unaffected.

Reports also indicate that customer information from banks, retailers, and gaming companies, including Steam operator Valve, may have been involved in the incident. Valve similarly stated that passwords and payment credentials were not exposed since CEVA did not have access to them.

Dutch data-protection authorities and law enforcement agencies are currently investigating the matter. At the same time, CEVA has not publicly identified the initial access method or attributed the attack to any known threat actor.

This incident highlights the supply-chain risks created when major retailers centralize fulfillment data with logistics providers. A compromise at one vendor can expose operational and customer information across multiple downstream brands, even when those brands’ customer-facing platforms remain secure.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world