Pokémon Center Notifies UK And Germany Customers Of Data Breach Tied To Shipping Partner, Cancels Some Orders
Pokémon Center customers in the United Kingdom and Germany are being notified that their personal information was exposed after hackers breached the systems of the company’s third-party logistics provider, with some orders canceled as a result.
Pokémon Center has begun notifying customers in the United Kingdom and Germany that their personal and order information was stolen after hackers breached CEVA Logistics, the third-party provider the company uses to ship products from PokemonCenter.com to those two markets. The exposed records belonged to customers who had placed orders on the site, with the information shared with CEVA to fulfill and ship those purchases.
CEVA Logistics operates as a subsidiary of CMA CGM Group, described as the world’s third-largest shipping company. The logistics provider runs 1,000 warehouses, processed 15 million shipments over the past year, and reported US$18.3 billion in revenue in 2025. Attackers breached CEVA’s servers between July 29 and August 1, an intrusion that affected multiple retailers across Europe and disrupted operations at eight of the company’s European warehouses, resulting in shipping delays for numerous customers.
The same breach also affected Valve, which notified European customers who purchased Steam hardware that their names, addresses, phone numbers, email addresses and information about ordered products had been stolen in the attack. Valve’s notification stated that CEVA retains delivery-related information for up to 90 days following an order, though it remains unclear whether that same retention window applies to the data CEVA held on behalf of Pokémon Center.
In breach notification emails sent to affected customers, Pokémon Center said CEVA serves as its shipping vendor for PokemonCenter.com orders in the United Kingdom and Germany and that CEVA had informed the company it was the target of a cyberattack beginning July 30, 2026. “We are writing to let you know about a cyber incident affecting a Pokémon Center logistics provider that may affect some of your information,” the notification said, adding that CEVA “were a victim of a cyber attack commencing on 30 July, 2026.”
Pokémon Center said unauthorized parties may have accessed customers’ full names, mailing addresses, phone numbers, email addresses and details about the contents of their PokemonCenter.com orders. The company said no other customer or order information was affected and confirmed that CEVA does not have access to customers’ payment card details.
Some customers also received separate emails notifying them that their orders had been canceled. “We’re sorry to inform you that we have had to cancel your recent order due to an unforeseen fulfilment issue,” one such notification said. It remains unclear why the cyberattack would necessitate order cancellations rather than delays alone. Early reports indicated cancellations affecting the company’s 30th anniversary collection merchandise, though customer reports also identified other affected items, including a Ghost Chateau Cyndaquil keyring. Additional customers have separately reported receiving the same cancellation notice.
Pokémon Center’s United Kingdom website currently displays a notice warning customers that some orders are experiencing delays and may take longer than usual to process, dispatch and deliver.
