Pokémon Center Data Breach Exposes Customer Information and Cancels Orders

Pokémon Center is notifying customers in the United Kingdom and Germany about a data breach involving logistics provider CEVA Logistics. The incident may have exposed personal and order information, while some affected Pokémon Center orders have been delayed or cancelled.

The breach did not expose payment card details, according to Pokémon Center. However, customers have reported cancelled orders for a range of products.

CEVA Logistics attack affects Pokémon Center customers

Pokémon Center uses CEVA Logistics to fulfil and deliver orders placed through PokemonCenter.com in the UK and Germany.

Attackers compromised CEVA’s systems between 29 July and 1 August 2026. The company reportedly experienced a cyberattack beginning on 30 July, which also disrupted several of its European warehouses.

Pokémon Center says unauthorised parties may have obtained customers’ full names, postal addresses, email addresses, phone numbers and details about the items in their orders.

The company shared that information with CEVA so it could process and ship customer purchases.

Payment information was not affected

Pokémon Center says CEVA does not have access to customer payment card data. As a result, the company does not believe card details were exposed in the incident.

It has not confirmed how many customers the Pokémon Center data breach affects. It is also unclear how long CEVA retained the affected delivery and order data.

CEVA is a major European logistics provider and a subsidiary of shipping group CMA CGM. The company operates around 1,000 warehouses and handles millions of shipments each year.

The same cyberattack also affected Valve. The company recently informed European Steam hardware customers that attackers had accessed delivery information connected to their orders.

Some customer orders have been cancelled

Pokémon Center has told some customers that it cancelled their recent orders because of an unforeseen fulfilment issue.

The retailer’s UK website also warns that some orders may take longer than usual to process, dispatch and deliver.

Customers have since reported cancellations involving more than one type of product. Early reports focused on anticipated 30th anniversary collection items, while other customers said their regular merchandise orders were also cancelled.

Pokémon Center has not explained why some orders required cancellation instead of a delay. It also has not said whether customers will be able to place replacement orders once fulfilment operations return to normal.

Customers should watch for phishing attempts

Anyone who receives a Pokémon Center data breach notification should be cautious of unexpected emails, texts or calls that claim to offer refunds, replacements or delivery updates.

Criminals often use publicly reported breaches to create convincing phishing messages. Customers should avoid clicking links in unsolicited messages and should instead visit Pokémon Center through its official website when checking an order.