The email arrives on a Monday and it is an apology. The order you placed — the one for a birthday still three weeks away — is canceled. The reason given is “an unforeseen fulfilment issue.” You reply asking why. Nothing comes back. That is how the Pokemon Center data breach reached most of the people it affected.
Then a second email arrives. This one knows the order number. It knows what was in the box. And it knows the address the box was going to, because it prints it back to you at the top. It says there is a small redelivery fee to release the parcel, and here is the link.
Nothing about that second message looks wrong, because every detail in it is right.
What Company Was Breached?
The breach did not happen at Pokémon Center — it happened at CEVA Logistics. That is the third-party company Pokémon Center uses to ship PokemonCenter.com orders to customers in the United Kingdom and Germany.
That is the part worth sitting with. The people affected have no relationship with CEVA Logistics. They ordered a plush toy or a card set from a website they trust. Then the website passed their details to a shipping contractor so the parcel could arrive.
CEVA is not a small operator. It is a subsidiary of the CMA CGM Group, the world’s third-largest shipping company. BleepingComputer reports that it runs about 1,000 warehouses, handled 15 million shipments last year, and reported 18.3 billion dollars in revenue in 2025. The same incident disrupted eight of its European warehouses, and Pokémon Center is one of several retailers it hit. Valve notified European Steam hardware customers of the same CEVA attack on 10 August, and Dutch retailers heard on 1 August.
When Did the Breach Occur?
Pokémon Center’s notification to customers says the attack on CEVA Logistics commenced on 30 July 2026. Valve, notifying its own customers about the same incident, gave a different window. It said attackers had access to CEVA’s servers between 29 July and 1 August 2026.
The two dates differ by a day. So we reproduce both here as each company stated them, rather than reconciling them into one number that neither company published.
- 29–30 July 2026 — the intrusion at CEVA Logistics begins, per the two notifications.
- 1 August 2026 — CEVA informs European retailers that a cyberattack has disrupted operations at eight of its warehouses.
- 7 August 2026 — Valve learns that the attackers likely compromised Steam customer information.
- 10 August 2026 — Valve emails affected European customers.
- 17 August 2026 — Pokémon Center customers in the UK and Germany receive cancellation and notification emails; BleepingComputer reports it the same day.
Between the intrusion and the Pokémon Center notification, roughly two and a half weeks passed.
What Was Stolen in the Pokemon Center Data Breach?
Pokémon Center says unauthorised parties may have obtained customers’ full names, mailing addresses, phone numbers and email addresses. The set also includes details about the contents of their PokemonCenter.com orders.
Nobody has published a figure for how many people this touches, and this Breakdown is not going to invent one. A Breach Breakdown usually leads on a record count. Here there isn’t one. Pokémon Center’s notification does not give a number, and the company has not responded to press enquiries. Have I Been Pwned has not catalogued the incident either. What we do know is the scope — customers of PokemonCenter.com in the United Kingdom and Germany — and the fields.
What appears not to be in the set, according to the same notification: Pokémon Center says CEVA does not have access to customers’ payment card details. It also says the attack did not affect other information related to customers and their orders.
Valve’s notification about the same incident describes the same shape of data. That means names, addresses, phone numbers, email addresses, and the type and price of products ordered. It also says CEVA had no access to payment information, passwords or Steam Guard codes.
One detail from Valve’s notice has no confirmed equivalent on the Pokémon Center side. Valve said CEVA retains delivery-related information for up to 90 days after an order. That is how it worked out who to warn. Neither company has stated whether the same retention window applies to Pokémon Center orders.
How Can This Breach Be Used Against You?
A name, a home address, a phone number, an email address and a description of what someone actually ordered is a potent combination. It makes a scam message sound like it came from a company you really do business with.
Valve put this to its own customers more directly than most breach notices manage. It warned that email, SMS or voice phishing may target them, impersonating Steam, Valve or delivery companies. The sender, it added, “may quote your address back to you to prove they’re genuine.”
Three concrete things that follow from a file shaped like this:
- A redelivery or customs-fee message. It refers to a real parcel, to the right address, and asks for a small payment to release it. The amount is deliberately trivial; what the scammer wants is the card details, not the fee.
- A refund email for the canceled order. This one is unusually dangerous here, because the cancellations were real. Somebody who has just heard from Pokémon Center about a canceled order already expects a follow-up message about it.
- A text to your actual mobile number about a delivery. A phone number in a breach file is a second door into the same person. It is also the one most people have no filter on at all.
The through-line is that each of these arrives in a channel you did not open. So somebody now holds the details needed to start a conversation with you whenever they choose to.
How to Protect Yourself After the Pokemon Center Data Breach
Most of what is worth doing here has nothing to do with any product, including ours. Do these first.
- Treat every message about this order as unverified — including the ones that are probably genuine. Do not use links in the email. Instead, go to pokemoncenter.com yourself, sign in, and look at the order there.
- Do not pay a fee to release a parcel from a link. A small redelivery or customs charge requested by email or text is the most common form this scam takes. If you think a charge might be real, look up the courier’s number independently and ask them.
- Expect someone else to start the refund conversation. A message may offer to process a refund for the canceled order and ask for card details to do it. But that is not how a retailer refunds an order it canceled itself.
- Check your address at haveibeenpwned.com — it is free and needs no account. One caveat specific to this incident: Have I Been Pwned has not catalogued the CEVA dataset. So a clean result does not rule you out of this one.
- A credit freeze is not the response this breach calls for. Payment card numbers, passwords and identity documents do not appear among the fields listed. Advice to freeze your credit is good advice about a different kind of breach. Following it here would cost you an afternoon and change nothing.
- If you are in the UK or Germany, you can report a scam message that follows. Valve said it was notifying the data protection authorities in the affected countries. So if a phishing attempt reaches you, report it locally. That is what turns one person’s experience into a pattern someone can act on.
How OptMsg Helps
OptMsg uses patent-pending opt-in technology. Mail from a sender you have not approved goes to Trash rather than to your inbox, and the app auto-deletes the contents of Trash after 30 days.
Be clear about what that does and does not mean. OptMsg would not have stopped the attack on CEVA Logistics. That happened inside a shipping contractor’s systems, which is not something an email product touches. Any company claiming otherwise is selling you something. What an opt-in inbox changes is what a leaked email address is worth to the person holding it afterwards.
An email address in a breach file is not embarrassing on its own. It is a channel, and it is the reason the fake redelivery notice can reach you at all. On an ordinary inbox, anyone who has the address can start a conversation. Your protection is that you personally notice something is off in the four seconds you spend looking at it. But on an opt-in inbox, mail from a sender you have not approved does not arrive in front of you in the first place.
What if something important lands in Trash?
That is the honest objection to the design, and OptMsg’s answer is Community Recommendations. When a message from an unapproved sender lands in Trash, OptMsg checks something. It asks whether many other OptMsg users have opted in to that sender as trusted. If they have, OptMsg flags the message and you get a push alert telling you there is something in Trash worth a look. That runs on other people’s choices, not on a filter guessing, and it sits inside the 30-day window before Trash empties.
Perhaps the Pokemon Center data breach is the moment you would rather decide who can email you than keep sorting out who already has. If so, that is what OptMsg’s security-first inbox is built around. You can set one up here.
Sources
- Pokémon Center customer notification, quoted in BleepingComputer — Pokémon Center data breach exposes customer info, cancels some orders, 17 August 2026
- Valve customer notification, quoted in BleepingComputer — Valve notifies Steam hardware customers of a data breach, 10 August 2026
- Forbes — Pokemon Center Customer Data Exposed As 3rd Party Breach Confirmed, 18 August 2026
- SC Media UK — Pokemon Center customers in UK and Germany affected by third-party data breach
- FreightWaves — Cyberattack on CEVA Logistics warehouses in Europe impacts retailers
A note on sourcing. Pokémon Center has not published a public statement page about this incident. The notification is a customer email, reported and quoted by BleepingComputer. The company had not responded to press enquiries at the time of writing.
Frequently Asked Questions
Was Pokémon Center itself hacked?
No. The breach happened at CEVA Logistics, the third-party company Pokémon Center uses to ship PokemonCenter.com orders to customers in the United Kingdom and Germany.
What information was exposed in the Pokemon Center data breach?
Pokémon Center says unauthorised parties may have obtained customers’ full names, mailing addresses, phone numbers and email addresses. Details about the contents of their orders were in the set too. The company says CEVA does not have access to customers’ payment card details.
How many Pokémon Center customers were affected?
Nobody has published a figure. Pokémon Center’s notification describes the affected group as customers in the United Kingdom and Germany without giving a number. Have I Been Pwned has not catalogued the incident.
Why was my Pokémon Center order canceled?
Pokémon Center’s notification email attributes the cancellations to “an unforeseen fulfilment issue” and then describes the cyberattack on its logistics provider. The company has not explained why the attack required cancellations rather than delays.
