Pokémon Center has begun notifying customers in the United Kingdom and Germany that their personal information was exposed during the recent cyberattack against logistics provider CEVA Logistics, with some customer orders also being canceled amid the disruption.
The notifications link the exposure directly to the CEVA Logistics cyberattack that disrupted eight European warehouses and affected shipments or customer information belonging to multiple organizations.
Pokémon Center customers are the latest confirmed victims tied to the incident, joining organizations including Valve, whose Steam hardware customers in Europe were also notified that delivery-related information may have been exposed.
Customer order information exposed
According to notifications sent to affected customers, CEVA Logistics, which handles Pokémon Center shipments for customers in the United Kingdom and Germany, informed the company that it had suffered a cyberattack beginning on July 30, 2026. The date broadly aligns with earlier reporting that disruption to CEVA’s European operations began around July 29.
Pokémon Center said unauthorized parties may have obtained:
- Customer names
- Mailing addresses
- Email addresses
- Phone numbers
- Order details, including purchased products
The company said other customer and order information was not affected. Payment card information was also not exposed through CEVA because the logistics provider does not have access to customers’ payment card details.
Affected customers have been notified directly by email.
Orders canceled alongside shipping delays
In addition to the data exposure, Pokémon Center told some customers that recent orders had been canceled because of what it described as an “unforeseen fulfilment issue.”
The cancellations have been reported in connection with the CEVA disruption, although Pokémon Center has not publicly explained why some affected orders were canceled rather than delayed.
Pokémon Center is also displaying a notice on its UK storefront warning that it is experiencing delays in processing and shipping some orders, which may take longer than usual to be dispatched and delivered.
Customers have reported cancellations affecting multiple products, indicating that the disruption is not limited to a single merchandise release.
Another customer caught in the CEVA incident
The disclosure adds Pokémon Center to the growing list of organizations affected by the CEVA Logistics cyberattack.
Earlier, Valve notified European customers that delivery-related information associated with physical Steam hardware orders may have been exposed after attackers compromised CEVA systems. Other organizations affected by the broader incident have reported operational disruption or potential exposure of customer information handled through CEVA facilities.
Valve’s notification stated that CEVA retains delivery-related information for approximately 90 days after an order. It remains unclear whether the same retention period applies to Pokémon Center customer information.
Scope of attack remains under investigation
CEVA Logistics has not publicly disclosed how attackers gained access to the affected systems or identified who was responsible for the intrusion. The total number of individuals whose information may have been exposed across CEVA customers also remains unknown.
Earlier reporting indicated that the incident affected eight CEVA warehouses in Europe while the company’s air, ocean, ground, and rail transportation management operations continued without interruption.
Pokémon Center’s customer notifications provide further evidence of the downstream impact of the attack, with the same incident now linked to both exposure of delivery information and disruption to order fulfillment across multiple CEVA customers.
CEVA Logistics and Pokémon Center had not issued detailed public statements at time of publication explaining the full scope of the Pokémon Center data exposure or the reason some affected orders were canceled.
