Pokémon Center has informed customers in the United Kingdom and Germany of a data breach that exposed their personal information. The incident originated from a cyberattack on CEVA Logistics, the third-party vendor responsible for fulfilling Pokémon Center orders in these regions.
In notification emails, Pokémon Center explained that CEVA Logistics experienced a cyberattack beginning on July 30, 2026. This breach compromised systems used to process delivery information, leading to the exposure of customer data. The affected information includes full names, mailing addresses, phone numbers, email addresses, and details about the contents of orders placed on PokemonCenter.com.
Importantly, Pokémon Center clarified that CEVA Logistics does not have access to customers’ payment card details, and other account information remains unaffected. However, the combination of exposed personal details and order information could be exploited for phishing or social engineering attacks targeting Pokémon collectors.
As a result of the breach, Pokémon Center has canceled a batch of pending orders. The UK website currently displays a notice warning customers of potential delays in processing, dispatching, and delivering orders. Some customers have reported outright cancellations, though the company has not provided specific reasons for this action.
The breach at CEVA Logistics has had broader implications, affecting customer data linked to various banks, retailers, and gaming companies, including Valve, the parent company of Steam. Valve has stated that passwords and payment credentials were not exposed, as CEVA did not have access to this information.
Authorities, including Dutch data protection agencies and law enforcement, are investigating the incident. CEVA has not disclosed the specific attack vector or identified the perpetrators behind the intrusion.
For Pokémon Center customers in the UK and Germany, the exposed data increases the risk of targeted phishing emails or fraudulent delivery scam messages referencing real order numbers. Customers are advised to verify any unsolicited communications through official Pokémon Center channels and remain vigilant against potential scams.
This incident highlights the growing trend of cyberattacks targeting logistics and fulfillment vendors, which can lead to widespread data exposures across multiple companies. Businesses must ensure that their third-party partners implement robust cybersecurity measures to protect customer information.
