Reported by 4 outlets

Timeline

1. original reporting

   Pokemon Center Data Breach: UK and German Customer Information Leaked, Some Orders Cancelled

   malware.news · 54d ago · August 20th, 2026

   Pokemon Center has notified customers in the United Kingdom and Germany that hackers stole personal information and order details from third-party logistics provider CEVA Logistics in a data breach. The cyberattack compromised CEVA's systems, which handle fulfillment for Pokemon Center orders. Some customer orders have been cancelled as a result of the breach.

2. update from bleepingcomputer.com

   Pokémon Center data breach exposes customer info, cancels some orders

   bleepingcomputer.com · 57d ago · August 17th, 2026

   While CEVA's systems were compromised in the cyberattack, the exposed records belonged to Pokémon Center customers who submitted orders on the site. The company then shared this information with the logistics provider to fulfill and ship PokemonCenter.com orders. CEVA Logistics is a subsidiary of the CMA CGM Group, the world's third-largest shipping company. The logistics provider operates 1,000 warehouses, handled 15 million shipments last year, and reported $18.3 billion in revenue in 2025. The company recently suffered a cyberattack in which attackers breached its servers between July 29 and August 1, affecting multiple retailers in Europe . The CEVA breach also affected Valve , which notified Steam hardware customers in Europe that their names, addresses, phone numbers, email addresses, and information about ordered products were stolen during the cyberattack. The Valve breach notification said CEVA said it retains delivery-related information for up to 90 days after an order. However, it is unclear whether the same retention period applies to Pokémon Center customer data. The attack also disrupted eight of its European warehouses, causing shipping delays for many customers.

3. update from cyberpress.org

   Pokémon Center Data Breach Exposes Customer Names, Addresses and Order Details

   cyberpress.org · 57d ago · August 18th, 2026

   The incident has also led to the cancellation of a batch of pending orders, extending the impact of a data-security event into customer service and supply chain disruptions . The retailer said its own website was not the source of the compromise. Instead, the exposure was traced to CEVA Logistics, which processes delivery information for retail clients. Pokémon Center Data Breach In breach-notification emails, Pokémon Center apologized for canceling recent orders due to an “unforeseen fulfillment issue” and then explained that CEVA had been the victim of a cyberattack. CEVA told Pokémon Center the activity began on July 30, 2026, affecting systems used in the fulfillment process. Pokémon Center said unauthorized parties may have accessed customers’ full names, mailing addresses, phone numbers, email addresses, and details about the contents of their PokémonCenter.com orders. The company said payment-card details were not involved because CEVA does not have access to that information. While the absence of payment data limits one category of immediate financial fraud, the exposed information still presents a material risk. Names, residential addresses, contact

4. update from gbhackers.com

   Pokémon Center Data Breach Exposes Customers’ Personal and Order Data

   gbhackers.com · 56d ago · August 18th, 2026

   Instead, attackers compromised the systems CEVA uses to […] The post Pokémon Center Data Breach Exposes Customers’ Personal and Order Data appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .