Pokémon Center warns UK and German shoppers after shipping partner is hacked

Key points

• Pokémon Center is telling shoppers in the United Kingdom and Germany that their personal details were exposed in a break-in at its shipping partner, CEVA Logistics.
• The hackers were inside CEVA's systems between 29 July and 1 August, according to the notice sent to affected customers.
• Stolen data includes full names, mailing addresses, phone numbers, email addresses and details of items ordered on PokemonCenter.com.
• Payment card details were not taken, because CEVA never held them.
• Some customers, including buyers of 30th anniversary merchandise, have had their orders cancelled outright with no clear explanation.

Pokémon Center did not get hacked. Its delivery company did.

The retailer is emailing shoppers in the UK and Germany to say that CEVA Logistics, the outside firm it pays to pack and ship orders from PokemonCenter.com, was broken into by criminals over the summer. Because Pokémon Center hands CEVA the details it needs to deliver a parcel, those details ended up in the hackers' reach.

The emails, first reported by BleepingComputer, tell customers that attackers may have taken their full name, address, phone number, email address and a description of what they ordered. No card numbers were exposed. CEVA never sees them.

What actually happened at CEVA?

Criminals broke into CEVA's computer systems between 29 July and 1 August and rifled through data belonging to several European retailers before being kicked out. CEVA is a subsidiary of shipping group CMA CGM. It runs 1,000 warehouses and moved 15 million shipments last year.

The same intrusion also hit Valve, the company behind the Steam gaming platform, which had to warn European buyers of Steam hardware that their delivery details were stolen too. Eight of CEVA's European warehouses were disrupted, which is why parcels across the continent have been slow.

CEVA has told Valve it keeps delivery information for up to 90 days after an order ships. Whether the same 90-day window applies to Pokémon Center shoppers is not yet clear.

What was taken, and from whom?

Detail	What we know
Retailer notifying customers	Pokémon Center (UK and Germany)
Third party breached	CEVA Logistics
Dates of intrusion	29 July to 1 August
Data exposed	Name, address, phone, email, order contents
Data not exposed	Payment card details
Other confirmed victim	Valve (Steam hardware buyers in Europe)

Why are orders being cancelled?

Alongside the breach notice, Pokémon Center is telling some shoppers their orders have been scrapped entirely, citing an "unforeseen fulfilment issue". The UK site carries a banner warning of delays.

Cancellations, though, are a step further than delays. Fans on Reddit have reported losing orders for the highly anticipated 30th anniversary range, and one shopper flagged that a Ghost Chateau Cyndaquil keyring was also pulled. Pokémon Center has not explained why a shipping problem would require killing orders rather than pausing them, and has not responded to press questions.

Should Pokémon Center customers be worried?

There is no sign of stolen card details, so this is not a wallet emergency. It is a phishing risk. Phishing is when criminals send fake emails or texts, dressed up to look like a real company, hoping you will click a link or hand over a password.

Someone holding your name, address and a list of the Pokémon merchandise you just bought can write a very convincing fake "delivery update" message. Treat any unexpected email or SMS about your order with suspicion. Do not click links inside it. Go to PokemonCenter.com directly, or your email inbox, and check the order status there.

If your order was cancelled, your money should be refunded automatically to the card you paid with. Watch your statement, and chase the retailer if a refund does not appear within a normal working week.

This is, in the end, a very old story with a new logo on it. Retailers keep learning that a break-in at a supplier is a break-in at them.