Pokémon Center Customers Exposed in CEVA Logistics Breach

Incident summary

A cyberattack on CEVA Logistics exposed delivery-related information belonging to Pokémon Center customers in the United Kingdom and Germany. Customer notifications made public on August 17, 2026 identify the affected fields as full names, mailing addresses, phone numbers, email addresses, and the contents of PokemonCenter.com orders. CEVA did not have access to payment-card data.

The incident matters because the affected data sat with a third-party fulfillment provider rather than the retailer's checkout system. Once a customer completes an order, the merchant must pass a narrow set of personal and order details to the warehouse and shipping operation. Compromise at that stage can expose enough context to support credible delivery, refund, and address-verification scams even without passwords or card numbers.

What was disclosed

Pokémon Center customer notices

Pokémon Center identified CEVA as the vendor used to ship PokemonCenter.com products to customers in the UK and Germany. The notices say CEVA was the victim of a cyberattack beginning on July 30 and that unauthorized parties may have obtained customer names, addresses, phone numbers, email addresses, and order contents. This is a newly confirmed downstream victim of the broader CEVA incident.

The exposed fields are ordinary fulfillment data, but their value changes when they are combined. A message that correctly cites a product, recipient name, delivery address, and order status can look substantially more credible than generic phishing. Attackers can use that context to invent a failed delivery, a refund problem, an address correction, or an additional-fee request.

Cancellations and delays

Pokémon Center told some customers that recent orders had been cancelled because of an unexpected fulfillment issue. Its UK storefront also warned that some orders were taking longer than usual to process, dispatch, and deliver. The breach therefore affected both confidentiality and the availability of order-fulfillment operations.

Operational disruption creates a useful pretext for fraud. Customers who are waiting for a cancellation, refund, or delayed shipment may be more receptive to a message asking them to reconfirm an address or payment. Order status should be checked by typing the official site address directly or opening a previously saved bookmark, not through links embedded in a new message.

Impact on CEVA's European operations

The CEVA incident began disrupting European contract-logistics operations around July 29 and affected eight warehouses. CEVA notified affected business customers on August 1 that goods in disrupted facilities were not shipping. Multiple retailers and service providers then issued their own notices as they established which customer records and fulfillment processes had been involved.

Ajax's official notice shows the response chain. After CEVA reported unauthorized access to part of its systems and data, Ajax suspended data exchanges with the logistics provider, reported the matter to the Dutch data-protection authority, and warned that orders and returns would take longer. The sequence illustrates how one provider incident can trigger data-transfer shutdowns, warehouse delays, regulatory reporting, and customer communications across many brands.

Why fulfillment data is sensitive

Online retailers share data with warehouse operators, packers, carriers, and returns providers after checkout. Those partners may process order numbers, product names, contact details, and physical addresses in separate systems. Strong security on the retailer's login and payment pages does not eliminate risk if a partner retains broad access, keeps data longer than necessary, or lacks a rapid notification path.

For customers, the distinction between a retailer breach and a logistics-provider breach is less important than the fact that real order information can be abused. The affected data did not need to include account credentials to make impersonation convincing. That is why the response should focus on independently checking delivery and refund requests rather than treating accurate order details as proof that a message is legitimate.

Checks for customers

Customers in the UK or Germany who ordered from Pokémon Center and received a notice should first inspect the order history on the official site. A message may contain a correct order number or product name because those fields were part of the exposed fulfillment data. Accuracy alone is therefore not a trustworthy signal.

• Type PokemonCenter.com directly and check the order, cancellation, and refund status
• Use the official support page for any request involving extra shipping fees or payment
• Do not provide passwords, authentication codes, or card details through delivery messages
• Confirm address changes and reshipment requests inside the official order page
• If information was entered on a suspicious page, secure the affected account and payment method promptly

Pokémon Center provides regional chat and email support through its official support site. Starting a new request there is safer than following a link in an unexpected cancellation or delivery message. Although card data was not among the CEVA-held fields in this incident, entering payment details into an impersonation page would create a separate financial risk.

Checks for retailers and logistics operators

Retailers should map the exact fields sent to each fulfillment partner, the purpose for each transfer, the retention period after delivery, and any onward copies used by subcontractors or returns platforms. Contract language should be backed by an inventory of partner accounts, APIs, file-transfer paths, and actual deletion controls.

• Map fulfillment fields and processing purposes for every logistics partner
• Compare stated deletion rules with observed retention after delivery
• Review least privilege and MFA for partner portals, SFTP accounts, and APIs
• Add data-transfer suspension and alternate fulfillment to continuity plans
• Make customer notices specific about fields, regions, and official verification channels

These reviews should be tested against logs and sample orders rather than treated as a paperwork exercise. Following a few completed orders across the retailer, partner portal, transfer files, and returns platform can reveal unnecessary copies and excessive retention. Teams should also rehearse how to identify pending orders and move them to an alternate warehouse after disabling a compromised connection.

Security containment and logistics continuity must be coordinated. Suspending data exchange can limit further exposure, but it may also stop dispatch and returns. Security, privacy, fulfillment, and customer-support teams should work from the same incident timeline and affected-order list so that notifications, refunds, and service recovery do not contradict one another.

Impact

The most practical risk for affected Pokémon Center customers is delivery or refund impersonation that uses genuine names, addresses, contact details, and product information. Messages asking for a corrected address, a small re-delivery fee, or card re-registration may appear credible precisely because the attacker can cite real order context.

The incident also offers a clear lesson for Korean e-commerce operators and other retailers that depend on outsourced fulfillment. Customer-data boundaries extend beyond login and payment systems into packing, shipping, and returns. Third-party incidents should therefore be tied directly to customer notification, alternate fulfillment, and service-recovery procedures.

Sources

AFC Ajax: Information About a Security Incident at a Logistics Partner

https://english.ajax.nl/articles/information-about-a-security-incident-at-a-logistics-partner/

Pokémon Center Support: How do I contact Pokémon Center Support?

https://support.pokemoncenter.com/hc/en-us/articles/38669040904212-How-do-I-contact-Pok%C3%A9mon-Center-Support

BleepingComputer: Pokémon Center data breach exposes customer info, cancels some orders

https://www.bleepingcomputer.com/news/security/pokemon-center-data-breach-exposes-customer-info-cancels-some-orders/

SecurityWeek: Ceva Logistics Operations Disrupted by Cyberattack

https://www.securityweek.com/ceva-logistics-operations-disrupted-by-cyberattack/

Evidence cutoff: August 18, 2026 at 06:00 KST.