Pokemon Center Data Breach: Customer Info Leaked, Orders Canceled

What Happened The official Pokemon Center has become the latest big brand to get caught up in a data breach. In late July 2026, hackers broke into CEVA Logistics, a third-party shipping company that handles Pokemon Center orders, and made off with customer personal and order information. The fallout has hit shoppers in the United Kingdom and Germany hardest, with Pokemon Center canceling a batch of European orders as a direct result.

This wasn't a breach of Pokemon Center's own servers — it's the classic supply-chain problem. Your data is only as safe as every vendor a company shares it with, and logistics partners like CEVA sit right in the middle of that chain, holding names, addresses, and order details for millions of packages.

Why This Keeps Happening Third-party breaches have become one of the most common ways personal data leaks out, precisely because hackers know smaller vendors often have weaker security than the retail giants they serve. Pokemon Center joins a growing list of companies whose customers got burned not because the main brand was hacked, but because a partner down the supply chain was. It's the same playbook seen across retail, gaming, and entertainment over the past few years.

Adding to the confusion, Pokemon Center customers have also recently been warned about unrelated phishing attempts tied to other tech products, like scam messages referencing the Steam Machine and Steam Controller. It's a reminder that when a real breach happens, it opens the door for a wave of copycat scams trying to trick people into clicking bad links.

What Customers Should Know If you've ordered from Pokemon Center recently — especially if you're in the UK or Germany — treat any order-related emails with extra caution right now. Canceled orders may trigger refund or reshipping emails, which is exactly the kind of message scammers love to imitate.

What To Do Right Now Check your Pokemon Center account for any official cancellation notices, and verify refund status directly through the site rather than clicking email links. Watch your inbox for phishing attempts disguised as shipping updates, and consider changing your password if you reuse it elsewhere. As always, legitimate companies won't ask for sensitive payment info or login credentials over email.

Pokemon Center hasn't detailed exactly how many customers were affected or what specific data fields were exposed beyond personal and order information, so more details may emerge as the investigation continues.