Pokémon Center Data Breach: UK and German Customers Affected

Pokémon Center has notified customers in the UK and Germany about a cyberattack on its logistics partner, CEVA Logistics, which resulted in the theft of customer personal data. The incident occurred in late July to early August 2026, when threat actors gained access to CEVA’s servers and stole order information from Pokémon Center’s website.

The security breach notification states that hackers may have accessed names, shipping addresses, phone numbers, email addresses, and order contents. Payment information was not compromised, as CEVA does not have access to such data. Some orders were canceled, while others face delays due to disruptions at eight European warehouses operated by the company.

CEVA Logistics, a subsidiary of global transport giant CMA CGM Group, serves numerous retailers across Europe. In 2025, the company processed 15 million shipments and generated $18.3 billion in revenue. The incident also affected Valve, which previously warned Steam users in Europe about a similar data leak. Pokémon Center has not explained why some orders were canceled instead of merely delayed.

Pokémon Center’s UK website includes a notice about potential delays in order processing and delivery. Reddit users report canceled orders, including popular items from the brand’s 30th-anniversary collection. The company has not responded to media requests for further details on the incident.