A logistics company related to Pokémon Centers was hacked, resulting in the leakage of customer information from the UK and Germany.



Pokémon Center users in the UK and Germany have been notified that a third-party logistics company working with

Pokémon Centers , which sell Pokémon-related products and merchandise, has stolen customer personal information and order data, resulting in a third-party data breach.

Pokémon Center data breach exposes customer info, cancels some orders
https://www.bleepingcomputer.com/news/security/pokemon-center-data-breach-exposes-customer-info-cancels-some-orders/



CEVA Logistics , a global supply chain company headquartered in France, suffered a server intrusion by attackers between July 29 and August 1, 2026, which affected multiple retailers in Europe.

The data breach at CEVA Logistics has also affected Valve , the operator of Steam. Around August 10, 2026, Valve sent a notice to some European customers stating, 'CEVA Logistics, which ships Steam hardware, has been cyberattacked. CEVA is still investigating the attack, but as of August 7, Valve has learned that it is highly likely that certain information about Steam customers, including you, has been leaked.' According to Valve, CEVA Logistics receives certain shipping information for Steam hardware shipments, and this information is retained for up to 90 days after an order is placed, making it highly likely that the attackers stole this information. The stolen data includes victims' names, addresses, phone numbers, email addresses, and the types and prices of products they ordered.

Furthermore, customers were notified that data from orders placed on the Pokémon Center website may have also been leaked. The Pokémon Center offers products that can be ordered online, and information for processing and shipping those orders was shared with CEVA Logistics.

In a data breach notification email obtained by BleepingComputer, the Pokémon Center explains that it uses CEVA Logistics to ship products from its online store 'pokemoncenter.com' to customers in the UK and Germany. The email states, 'We regret to inform you that we have had to cancel your recent order due to unforeseen shipping issues. We are very sorry. We would like to inform you that some of your information may be affected by a cyberattack that impacted Pokémon Center's logistics provider. CEVA Logistics, the company that Pokémon Center uses to ship products to customers in the UK and Germany, has reported to us that it was affected by a cyberattack that began on July 30, 2026.' It is unclear why the cyberattack necessitated cancellations rather than simply delays in shipping.

The following is the content of a notification email reported by an X user: 'It appears that orders for 'Pokemon 30th Anniversary merchandise' have been canceled for some people.'




On Reddit, there were also reports that some of the items in a multiple-item order were canceled, including a keychain featuring Cyndaquil as a mascot from the Halloween-themed ' Halloween Ghost Chateau ' collection.



According to the Pokémon Center, similar to the Valve incident, a third party may have obtained customers' names, addresses, phone numbers, email addresses, and details of orders placed on PokemonCenter.com. Other customer and order information remains unaffected, and CEVA Logistics does not have access to customers' payment card information, so there is no concern about card information being leaked.

In connection with this matter, the UK Pokémon Center website has posted a notice warning that 'some orders are experiencing delays and may take longer than usual to process, ship, and deliver.'



BleepingComputer has contacted Pokémon Centers and Pokémon media representatives to find out more about the data breach and why customer orders were canceled as a result, but has not received a response.

Related Posts:

in Web Service,   Security, Posted by log1e_dh