Pokémon Center

Summary

Pokémon Center notified customers in the United Kingdom and Germany that a cyberattack on its logistics provider CEVA Logistics exposed personal and order information, including names, addresses, phone numbers, email addresses and details of purchased items, while confirming that payment card data was not compromised. The breach, which also affected Valve and several other European retailers, led the retailer to cancel affected orders citing an unforeseen fulfillment issue and to warn of possible shipping delays. CEVA reported that the attack disrupted eight of its European warehouses, contributing to the cancellations and delays.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 30 2026 CEVA Logistics disclosed that its systems had been compromised in a cyber attack that began on July 30 2026, affecting multiple retailers across Europe. The breach exposed personal and order information of Pokémon Center customers in the United Kingdom and Germany, including full names, mailing addresses, phone numbers, email addresses, and details of the items ordered from PokemonCenter.com. Pokémon Center subsequently sent notification emails to affected customers stating that their recent orders had been cancelled due to an unforeseen fulfilment issue and informing them of the cyber incident involving its logistics provider. The company also posted a notice on its UK website warning that some orders might experience delays in processing, dispatch, and delivery.

The data breach at CEVA Logistics coincided with a similar incident that impacted Valve’s Steam hardware customers in Europe, with CEVA confirming that it retains delivery‑related information for up to 90 days after an order. CEVA, a subsidiary of the CMA CGM Group, operates approximately 1 000 warehouses, handled 15 million shipments in the prior year, and reported $18.3 billion in revenue for 2025. The attack disrupted eight of CEVA’s European warehouses, causing shipping delays for a range of clients including Dutch retailer Bol, football club Ajax, ING Bank, and eyeglass maker Ace & Tate. Pokémon Center’s notification arrived during its 30th‑anniversary promotion, a period when the site featured over 100 themed items and experienced high traffic that already produced long queues and rapid sell‑outs of new products.

As a result of the breach, affected customers reported that cancelled orders left purchased items out of stock or unable to arrive in time for events such as birthdays, and they expressed concern about increased vulnerability to phishing scams given the exposure of their personal data. Pokémon Center did not provide further explanation for why the cyberattack necessitated order cancellations rather than merely delays, and inquiries to the company and its media contacts went unanswered. The incident highlighted the ripple effects of a third‑party logistics compromise on retail operations, customer trust, and order fulfillment during a peak sales period.

Sources

Sources available to members: 3 sources.