Pokémon Center Customer Data Exposed in CEVA Logistics Cyberattack

Key Takeaways

• Customer Data Exposed Through Third-Party: Pokémon Center says a cyberattack on logistics provider CEVA Logistics may have exposed the names, mailing addresses, phone numbers, email addresses and order details of customers in the U.K. and Germany.
• Payment Card Data Was Not Affected: Pokémon Center said CEVA does not have access to customers’ payment card details and that other information related to customers and their orders was not impacted.
• Attack Disrupted European Operations: The CEVA cyberattack affected eight European warehouses, causing shipping delays for customers of multiple retailers.
• Pokémon Center Orders Were Canceled: Some customers received cancellation notices following the incident, although the reason the cyberattack resulted in cancellations rather than delays alone remains unclear.
• Other CEVA Clients Were Affected: Valve also notified European Steam hardware customers that personal and order information was stolen in the same CEVA breach.

Deep Dive

Pokémon Center is notifying customers in the United Kingdom and Germany that personal and order information may have been exposed in a cyberattack on CEVA Logistics, the third-party provider it uses to fulfill and ship orders in those markets.

According to BleepingComputer, unauthorized parties may have obtained customers’ full names, mailing addresses, phone numbers, email addresses and details about the contents of their PokemonCenter.com orders. Pokémon Center said other information related to customers and their orders was not affected, and that CEVA does not have access to customer payment card details.

The incident began at CEVA, not Pokémon Center. The logistics provider was compromised in an attack that affected its servers between July 29 and Aug. 1 and disrupted operations at eight warehouses in Europe, contributing to shipping delays for customers of multiple retailers. CEVA is a subsidiary of CMA CGM Group, the world’s third-largest shipping company, and operates about 1,000 warehouses. It handled 15 million shipments last year and reported $18.3 billion in revenue in 2025.

Pokémon Center said CEVA is the vendor it uses to ship PokemonCenter.com products to customers in the U.K. and Germany. The information exposed in the breach had been shared with the logistics provider for fulfillment and delivery.

Valve was also affected by the same incident. The company notified Steam hardware customers in Europe that names, addresses, phone numbers, email addresses and information about ordered products had been stolen during the attack, according to earlier reporting by BleepingComputer.

Valve’s notification said CEVA retains delivery-related information for up to 90 days after an order. It is not clear whether the same retention period applies to Pokémon Center customer data.

The disruption has also affected order fulfillment. Pokémon Center is displaying a notice on its U.K. website warning that some orders are experiencing delays and may take longer than usual to process, dispatch and deliver. Some customers, however, have reported that orders were canceled altogether.

In notifications obtained by BleepingComputer, Pokémon Center told customers that recent orders had been canceled because of an “unforeseen fulfilment issue.” The company then informed recipients that CEVA had reported being the victim of a cyberattack beginning July 30.

Initial customer reports involved orders for products from Pokémon’s 30th anniversary collection, while other merchandise also appears to have been affected. BleepingComputer cited a Reddit post from a customer who said an order for a Ghost Chateau Cyndaquil keyring had been canceled, with another customer reporting that they had received the same cancellation email.

It remains unclear why the cyberattack resulted in some orders being canceled rather than only delayed. BleepingComputer said it contacted Pokémon Center and Pokémon media representatives for more information about the breach and the cancellations but had not received a response at the time of publication.

The incident adds Pokémon Center to the list of companies dealing with the fallout from the CEVA attack, which has combined data exposure with disruptions to physical fulfillment across parts of Europe. For organizations that rely on third-party logistics providers, it is another example of how a cyber incident inside a vendor’s environment can quickly extend into privacy, supply-chain and operational concerns for the companies that depend on it.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.