CEVA Logistics Cyberattack Exposed Delivery Data and Disrupted Pokémon Center Orders

A cyberattack on CEVA Logistics, the fulfillment provider used by Pokémon Center in the United Kingdom and Germany, disrupted European warehouse operations and may have exposed customer delivery and order data. The incident did not originate in Pokémon Center’s website or customer-account systems, and available reports say payment-card information was not exposed through the Pokémon Center impact.

The immediate customer problem is twofold: some orders were canceled or delayed, and affected shoppers may now receive unusually convincing scams referencing real products, addresses, or order problems.

What happened at CEVA Logistics?

CEVA Logistics is the France-headquartered contract-logistics arm of CMA CGM. It operates more than 1,000 warehouses worldwide and handles fulfillment and shipping for multiple retailers and technology companies.

Attackers accessed CEVA systems from approximately July 29 through August 1, 2026. The intrusion disrupted parts of CEVA’s European contract-logistics operations; reporting identified eight affected warehouses, where shipments were halted or could not be dispatched. CEVA notified affected customers on August 1 that goods held at the disrupted facilities were not shipping.

CEVA was still investigating in the latest reports. The intrusion method, the complete number of affected people, the precise data accessed, and whether information was removed have not been publicly established. No ransomware group or other attacker had claimed responsibility in the available reporting.

How were Pokémon Center customers affected?

Pokémon Center notified customers in the UK and Germany that CEVA had suffered a cyberattack affecting information used to fulfill PokémonCenter.com orders. The information was held by the logistics provider so it could deliver products; Pokémon Center said the incident was not a compromise of its own customer accounts or payment processing.

Customers reported two main operational effects:

• Canceled orders: Pokémon Center canceled some pending orders, including reported pre-orders for Pokémon 30th-anniversary card merchandise.
• Shipping and fulfillment delays: Other orders were delayed as the affected logistics operations were disrupted.

The Ghost Chateau Cyndaquil keyring has been discussed in customer reports in connection with the disruption, but the available evidence does not show that Pokémon Center publicly identified that specific SKU as compromised or officially canceled. It should therefore not be presented as a confirmed example.

Why were some orders canceled instead of delayed?

Pokémon Center has not publicly explained the decision for individual orders. Possible operational explanations include unreliable fulfillment records, difficulty locating or allocating inventory, or a need to rebuild affected orders safely. Those are reasonable possibilities—not confirmed findings.

A cancellation also does not prove that the associated customer data was stolen, nor does it prove that the data was safe. The order status may reflect a fulfillment decision made after the incident rather than the outcome of the forensic investigation.

What information may have been exposed?

For affected Pokémon Center customers, reported or potentially exposed information includes:

• Full name
• Delivery or billing address
• Email address
• Telephone number
• Order information, including products ordered and related fulfillment details

This is not the same as a password or payment-card breach. Pokémon Center’s notifications and reporting indicate that its own website and customer-account systems were not compromised and that payment-card information was not accessed through this incident.

That distinction lowers the direct risk of card theft or account takeover from the CEVA exposure. It does not eliminate risk: a scammer with a real name, address, email address, and product detail can make a fake delivery or refund message look authentic.

Which other companies were affected?

CEVA’s role as a shared logistics provider meant that the incident reached beyond Pokémon Center. Organizations reported as affected or notifying customers included:

• Valve, for European Steam hardware buyers
• Dutch retailers bol and De Bijenkorf
• ING
• Ace & Tate
• Ajax

Reporting described roughly a dozen affected organizations, but the list may not be complete while the investigation continues.

Valve separately warned European customers who had purchased physical Steam hardware, including the Steam Deck, Steam Machine, or Steam Controller. The potentially exposed information included delivery-related details, while Valve said Steam passwords, payment-card numbers, and Steam Guard codes were not involved.

This was therefore a supply-chain compromise at a logistics provider rather than a direct breach of Steam or Pokémon Center.

Why the phishing risk is unusually high

The exposed information is particularly useful for social engineering because it can help an attacker create a message that appears to confirm something the recipient already expects. Treat unsolicited messages as suspicious even when they mention a genuine product, order, address, or cancellation.

Common lures could include:

• A request to pay a “redelivery” or customs fee
• A claim that a canceled 30th-anniversary item has been recovered or restocked
• A fake refund or replacement offer
• A request to confirm an address, card, password, or one-time code
• A message impersonating Pokémon Center, CEVA, Valve, a courier, a bank, or a customs agency

CEVA has separately warned that scammers use its name, logo, letterhead, employee identities, and fake websites in fraudulent correspondence.

What affected customers should do now

1. Check orders only through official sites or apps. Open the Pokémon Center or Steam account portal directly using a saved bookmark or manually entered address. Do not use links in unexpected emails, texts, or social-media replies.
2. Do not pay to “release” a parcel. Contact the retailer, carrier, or bank through contact details obtained independently—not through the message you received.
3. Never share passwords or one-time codes. A delivery, refund, or replacement request should not require an account password, MFA code, or Steam Guard code.
4. Secure the email account used for the order. Use a unique password and enable multi-factor authentication. Change any other account password where the same email-and-password combination was reused.
5. Monitor payment activity. The incident does not indicate that Pokémon Center payment-card data was exposed, but contact your card issuer through its official number if you see an unfamiliar transaction.
6. Keep records. Save order confirmations, cancellation emails, refund information, and tracking details. Use official support to ask about a canceled order or any available refund or reorder option.
7. Be cautious about physical-world impersonation. Unexpected callers, visitors, or messages referencing your home address or a supposedly recoverable parcel deserve extra scrutiny.

The central lesson is that a logistics breach can affect customers even when the retailer’s main website remains secure. In this case, the known exposure is centered on delivery and order information, while the reason for individual Pokémon Center cancellations and the full extent of the CEVA compromise remain unresolved.