Pokémon Center data breach: what UK and German shoppers should know

In late July 2026, attackers broke into systems at CEVA Logistics, the firm Pokémon Center uses to ship orders from its UK and German online stores. Pokémon Center later emailed affected customers that information it had shared with CEVA to pack and send those orders — full names, home addresses, phone numbers, email addresses, and details of what was in the parcels — may have been taken. Payment-card numbers were not included, because CEVA never had them.

CEVA told reporters the intrusion began on 30 July 2026 and hit eight of its European warehouses. Pokémon Center’s emails started reaching UK and German customers around mid-August 2026, and some recent orders were cancelled because of the disruption. Neither company has said how many Pokémon Center shoppers were involved, and there has been no public notice beyond those emails and a generic delays banner on the UK site.

Your card was never in this file. Your home and your order were.

Almost every account of this incident leads with the same line: no payment data was allegedly stolen. That is accurate, and it is the least useful part of the story for anyone who actually ordered something.

What CEVA held was the information needed to put a parcel on a doorstep: who you are, where you live, how to phone or email you, and what was in the box. That is what Pokémon Center says may now be in someone else’s hands. It is not a bank breach. It is a named list of households, at real addresses, tied to recent purchases from a well-known store.

That mix is what makes the next message hard to ignore. A note that uses your real name, mentions a real order, and talks about a “fulfilment issue” or a cancelled shipment will look like the store — especially if you are still waiting to find out whether your order is coming. The same details are also enough for junk calls, scam texts, and, over time, for people-search sites that stitch a leaked address onto the rest of a person’s public record.

Nothing here suggests passwords, card numbers, or official ID documents were taken. The honest read is narrower and still worth acting on: someone may now be able to reach you, at home and in your inbox, with facts only the shop and its shipper should have had.

What to actually expect

• Messages — some genuine, many not — about a Pokémon Center order, a delay, or a cancelled shipment. Pokémon Center has already used that language with customers. Scammers will copy it.
• No public list, no headcount, and no page where you can look up whether you were included. The only direct notice described so far is an email from Pokémon Center to people it believes were affected.
• No new card charges that come from this incident. CEVA did not have payment-card data, so a surprise debit is a separate problem.
• The leaked records will not disappear. Copies of a name, address, phone number, email address, and order details cannot be recalled once taken.

What you can and cannot fix

If your details were in CEVA’s files, they are out. A name, a home address, a phone number, an email address, and a description of what you ordered cannot be un-leaked. No company or takedown request can pull that data back from whoever has it now.

What still helps is shrinking how those facts can be used against you, in this order:

• Treat every unexpected order or “fulfilment” message as untrusted. Do not click links or call numbers in the message. Open Pokémon Center’s site yourself, or use a contact method printed on a previous dispatch note, and check there.
• Harden the email account they now have. This breach did not include your password, but it did include an inbox they can write to. A unique password and two-step sign-in on that email account stop a convincing fake from becoming a takeover of everything else you receive.
• Ignore calls or texts that already know your order. Hang up and start again from the official site. Real shipping problems do not need you to read out a card number or a one-time code.
• Remove yourself from people-search listings. A bare leaked record becomes much more useful when it is joined to pages that add relatives, old addresses, extra phone numbers, and employers. Those listings, unlike the stolen CEVA file, can actually be taken down. Opting out of them is the one step that reduces how complete a stranger’s picture of you can become.