Pokémon Center has begun notifying customers in the United Kingdom and Germany about a third-party data breach that exposed personal and order information. The incident stemmed from a cyberattack on CEVA Logistics, a vendor Pokémon Center uses to fulfill and ship orders from PokemonCenter.com in those regions.
CEVA Logistics, a subsidiary of the CMA CGM Group, confirmed it was the victim of a cyberattack that began on July 30, 2026. The breach compromised CEVA's systems between July 29 and August 1, affecting multiple retailers in Europe. This attack also impacted Valve, which previously informed its European Steam hardware customers that their names, addresses, phone numbers, email addresses, and product order details were stolen.
According to Pokémon Center's notification emails, unauthorized parties may have obtained customers' full names, mailing addresses, phone numbers, email addresses, and specific details about the contents of their PokemonCenter.com orders. The company emphasized that other customer-related information was not affected and that CEVA does not have access to customers' payment card details.
The cyberattack has led to significant disruptions, including shipping delays and the cancellation of some Pokémon Center orders. While a notice on the Pokémon Center UK website acknowledges delays, customers have reported receiving cancellation emails for various merchandise, not just highly anticipated collection products. The specific reason why the breach necessitated cancellations rather than just delays remains unclear.
CEVA Logistics operates 1,000 warehouses and handled 15 million shipments in 2025, reporting $18.3 billion in revenue. The attack disrupted eight of its European warehouses, contributing to the shipping issues. Valve's breach notification indicated that CEVA typically retains delivery-related information for up to 90 days post-order, though it is not confirmed if the same retention period applies to Pokémon Center customer data.
