Cyberattack on CEVA Logistics Exposes Pokémon Center Customer Data

A cyberattack on CEVA Logistics, a third-party shipping vendor, exposed the personal data of Pokémon Center customers in the United Kingdom and Germany. The breach began on July 30, 2026, and compromised customer names, mailing addresses, phone numbers, email addresses, and order details.

Pokémon Center confirmed that its own internal systems were not hacked and that user accounts and payment card details remain secure. However, the incident caused operational disruptions, including shipping delays and the cancellation of several recent orders for customers in the United Kingdom.

The attack affected approximately a dozen organizations, including Valve Corporation and Dutch retailers Bol and De Bijenkorf. To contain the breach, CEVA Logistics shut down portions of its IT infrastructure, which impacted eight warehouses. No threat actor has claimed responsibility for the attack.