Pokémon Center data breach: was my name, address and order exposed?

Pokémon Center has emailed customers in the United Kingdom and Germany that CEVA Logistics — the company that ships PokemonCenter.com orders to those countries — was hit by a cyber attack beginning on 30 July 2026. Unauthorised people may have obtained full names, mailing and shipping addresses, phone numbers, email addresses, and details of what was in the affected orders. CEVA does not hold payment-card data, and Pokémon Center says other customer and order information was not affected.

Some recent orders were cancelled because of what the company called an “unforeseen fulfilment issue.” Its UK website and support pages, updated around 12 August 2026, say only that some UK orders are delayed. They do not mention the data. Pokémon Center has not said how many people were included. CEVA has separately confirmed a cyber attack on its European warehouses from late July 2026.

No card numbers were taken. That is not what puts you at risk.

The first fact you will hear is that your payment card was not in CEVA’s systems. That is true. It is also not the part that changes anything for you this week.

What may now be in someone else’s hands is your name, the address the parcel was going to, a phone number, an email address, and a description of the Pokémon items in the order. That is not a bank-fraud file. It is a contact list of real households with a shopping receipt attached.

Someone can now write to you, or ring you, already knowing who you are, where the order was going, and what you bought. That is how a fake “your order was cancelled — confirm your details to reship” message gets believed. If you buy higher-value collectibles, the same record is also a note that a named person at a known address buys those things. Most people will meet the first problem, not the second. Either way, “no financial data” is not the same as “nothing sensitive left.”

This notice is about PokemonCenter.com orders sent to the UK and Germany. A cancelled order does not prove your details were copied, and a delivered order does not prove they were not. There is no public figure for how many customers were included, and no public list of names.

What you should actually expect

• If you had a PokemonCenter.com order going to the UK or Germany, check your inbox and spam for a message from Pokémon Center itself. That is how they are telling people. A real notification does not ask you to click a link, call a number, or re-enter a card.
• Some recent orders were cancelled, and some UK deliveries are late. Neither fact, on its own, tells you whether your personal details were in the stolen set.
• In the coming weeks, expect emails, texts or calls that mention a Pokémon Center order, a refund, a reshipment or a customs problem, and that already use your real name or a real item you bought. Do not reply. If you need to check an order, type the official Pokémon Center site into your browser yourself.
• You should not treat a “clear” result on a breach-checking site as proof you were spared. This kind of vendor list is rarely in those searches, and there is no public lookup for this incident.

What you can and cannot fix

If your name, address, phone number, email address and order details were among the CEVA records that were accessed, that copy is out. It cannot be recalled, wiped from the attacker’s side, or frozen the way a card can. An address that has been taken stays taken.

What still helps, in this order:

• Treat unexpected contact about this order as hostile unless you started it. Anyone who can cite your real purchase already has the one fact that makes a scam feel genuine. Hang up, delete the message, and only use the official site you typed yourself.
• Tell the other people in your household. The phone and the door belong to everyone who lives there. A convincing courier story or “Pokémon Center called” line will often be tried on whoever answers.
• Cut back the extra personal data already published about you. A bare leaked order record becomes much more useful when it is joined to people-search and directory listings that add relatives, extra phone numbers, employers and previous addresses. Those listings, unlike the stolen CEVA file, can actually be taken down. You cannot unspread the breach. You can stop handing over the rest of the picture.
• If you keep valuable collectibles at home, treat the address as known. That is not a prediction of a break-in. It is a reason to stop tying what you own to your real name on public profiles, and to be wary of unexpected “delivery” visits you did not arrange.