The fallout from the CEVA Logistics cyberattack has spread beyond Valve's Steam hardware customers in Europe, now confirmed to have hit Pokémon Center operations in the UK and Germany. The shipping partner notified the official Pokémon merchandise store that customer data was compromised during a breach window between 29th July and 1st August, mirroring the incident Valve disclosed days earlier. For players who pre-ordered limited-run collectibles or anniversary merchandise, this isn't just a privacy notice — it means cancelled orders with no guarantee those items will return to stock.
Pokémon Center has confirmed that full names, mailing addresses, phone numbers, email addresses, and order details were exposed to the attackers. Payment and card details remain safe because the retailer does not share that information with CEVA Logistics, a critical distinction that limits financial risk for affected buyers. The breach has also triggered shipping delays across the Pokémon Center UK website, with the company posting a notice acknowledging longer-than-usual dispatch and delivery times. Customers whose orders were cancelled will see only a payment authorisation on their cards, which should drop off within seven days, and a 20% off coupon valid until 30th November has been issued as goodwill.
What the Breach Means for Pokémon Center Customers
The scope of leaked data matches what Valve's Steam hardware customers received in their notifications: personal identifiers and order contents, but no payment credentials. This consistency suggests CEVA's systems were accessed in a similar fashion across both partners. Pokémon Center told affected customers it is "in conversation" with CEVA to understand the full scope and ensure measures are put in place to prevent repeats, while also monitoring its own systems to confirm the website itself was not compromised. The retailer stressed that its website remains unaffected by the attack, meaning the breach was isolated to the logistics partner's infrastructure.
For anyone who placed an order during the breach window, the practical impact goes beyond data exposure. Pokémon Center cancelled the affected orders outright rather than attempting to reroute or fulfill them through alternative logistics. That decision means customers must reorder manually if stock remains — and with highly anticipated 30th anniversary products among the cancelled items, restocking is far from guaranteed. The 20% off coupon softens the blow but does not solve the core problem: limited-run merchandise may simply be gone by the time a customer attempts a new purchase.
Shipping Delays and the Broader Fallout
Beyond the cancelled orders, the breach has created a ripple effect on Pokémon Center's UK operations. The site currently displays a message warning that processing and shipping delays are ongoing, with some orders taking longer than usual to dispatch and deliver. This suggests CEVA's operational capacity has been degraded by the incident, affecting even orders not directly tied to the compromised data set. Customers waiting on existing shipments should expect extended timelines, and the retailer has not provided a specific date for when normal service will resume.
The situation mirrors what Steam hardware buyers in Europe experienced after Valve's disclosure, reinforcing that CEVA Logistics serves as a critical shipping artery for multiple high-profile gaming brands in the region. Both companies received similar breach notifications from the logistics provider, and both have had to manage customer communications, order cancellations or delays, and goodwill gestures in parallel. For the gaming hardware and merchandise ecosystem, this highlights a single point of failure in European fulfillment that multiple publishers now share.
What to Watch Next
Pokémon Center has committed to working with CEVA on preventive measures, but no timeline has been given for when the logistics partner's security posture will be independently verified. The retailer's own systems remain under monitoring, and the website is currently operational aside from shipping delays. Customers should watch for restock announcements on 30th anniversary products, though the company has explicitly stated there is no guarantee cancelled items will return to inventory. Valve's handling of the Steam hardware side of this breach may also offer a template for how Pokémon Center manages ongoing communications and potential further compensations.
