Pokémon Center UK Breach Hits Orders

Pokémon Center customers in the UK who recently placed orders may find them unexpectedly canceled. The company has issued warnings about a cyberattack on its logistics provider, CEVA Logistics, which has disrupted its fulfillment operations.

Unforeseen Fulfillment Issue

Pokémon Center, the official merchandise store, sent emails to affected customers stating they had to "cancel your recent order due to an unforeseen fulfilment issue". The company's website also displays a notification acknowledging delays: "These orders may take longer than usual to process, dispatch, and deliver. We apologize for the inconvenience and appreciate your patience."

CEVA Logistics Cyberattack

In an email to customers, Pokémon Center explained, "CEVA Logistics, the vendor Pokémon Center utilizes to ship products from PokemonCenter.com for customers in the United Kingdom and Germany, has informed us that unfortunately they were a victim of a cyber attack commencing on 30 July, 2026."

Last week, CEVA Logistics, one of the world's largest shipping and logistics companies, disclosed an incident that forced it to shut down parts of its IT infrastructure and affected eight warehouses. Several customers reported being affected, including Dutch retailers Bol and De Bijenkorf, and PC gaming powerhouse Valve.

Data Likely Exposed

Pokémon Center stated that the data most likely exposed includes full names, mailing addresses, phone numbers, email addresses, and details about previous orders on the site. User accounts and payment details are reportedly safe.

About a Dozen Organizations Affected

So far, around a dozen organizations are confirmed as affected. No threat actors have claimed responsibility for the attack yet.

• Cyberattack began on July 30, 2026
• Approximately a dozen organizations affected
• Eight warehouses impacted

Impact on Customers

The breach could expose sensitive personal information that might be used for phishing or identity theft. Customers who ordered from Pokémon Center UK should monitor their accounts and be cautious of unsolicited communications referencing their order history.

No Claim Yet

The lack of a claim is not unusual in early stages of an attack. Threat actors often take time to assess stolen data before making demands or public statements. Affected companies have confirmed the incident, but no further official statements have been released.

Supply Chain Vulnerabilities

This incident highlights the often-overlooked vulnerability of third-party logistics providers. While consumers focus on the security of platforms they directly use, a breach at a shipping partner can expose just as much sensitive data, including addresses and purchase history. For companies like Pokémon Center, the reputational damage can be significant even if their own systems are unaffected.

Why It Matters

This breach underscores the interconnected nature of modern supply chains, where a single compromise can have cascading effects on numerous downstream partners. For customers, the takeaway is to be proactive about protecting personal information, especially in the aftermath of any third-party breach. The incident suggests that even companies with strong security can be impacted by vulnerabilities in their partners' systems.