Pokémon Center data breach: what UK and Germany customers need to know

Pokémon Center has emailed some customers that CEVA Logistics — the company that ships PokemonCenter.com orders to the United Kingdom and Germany — was the victim of a cyber attack beginning on 30 July 2026. In those emails, Pokémon Center said unauthorized parties may have obtained customers’ full names, mailing addresses, phone numbers, email addresses, and details about the contents of their orders. Payment-card details were not accessed.

Some recent orders were cancelled because of what the emails called an “unforeseen fulfilment issue” tied to the incident. The public UK site and support pages mention only processing and shipping delays. Pokémon Center has not said how many people or orders were affected, and it has not published a statement beyond those private emails.

Your card being safe is not the same as you being untouched

The first line you will see about this is the reassuring one: a shipping contractor was attacked, not the shop’s checkout, and card numbers were not taken. That is true. It is also the least useful part of the news if you are trying to decide what this means for you.

What left CEVA is a working contact sheet. A name, a home address, a phone number, an email, and a note of what that person had just ordered from the official Pokémon store. That is enough for someone to write to you about an order you really placed, to mention a cancellation you may already have seen, or to arrive in your inbox as “CEVA” or “Pokémon Center support” with details that feel internal.

It is also enough to know that a parcel was meant for that address. Coverage that leads with “no payment cards” is answering a question most people are not actually asking. The question is whether a stranger can now talk to you, about your order, at your house. For customers whose records were in CEVA’s files, the honest answer is yes.

That does not mean every Pokémon Center customer is in the file. CEVA was used for UK and Germany shipments. If you have never had a PokemonCenter.com order sent to those countries, this incident as described is not about your data. If you have, Pokémon Center has not said whether every recent order was included or only some, or which dates sit in the stolen set. There is no public list, and no checker can honestly tell you that you were — or were not — in this specific incident.

What you should actually expect

• Emails, texts, or calls about a cancelled Pokémon Center order, a reshipment, a refund, or a delivery problem. Some orders really were cancelled, and the company already used that wording, so the first scams will copy it.
• Contact that uses your real name and address and claims to be Pokémon Center, CEVA, or a courier. Correct details do not make the sender genuine.
• The official website will keep talking about delays and will not spell out a breach. That is already how the public pages read. Silence there is not a sign you were spared.
• Unexpected card charges are not the fingerprint of this incident. If a card you used is charged strangely, treat that as a separate problem with your bank.

What you cannot undo — and what still helps

If your details were in CEVA’s files, they are out. A name, a mailing address, a phone number, an email address, and a description of an order cannot be pulled back. No company can delete them from whoever took them. Anyone offering to remove you from the breach is selling something they cannot do.

What still helps, in this order:

• Treat unsolicited contact about a Pokémon Center or CEVA order as a scam, even if it cites a real cancellation or a real product. Use only an account page or phone number you already had — not a link or number in the message.
• Watch the inbox and the phone number you used at checkout. That is how follow-up scams will arrive. You do not need to replace a card because of this incident alone.
• Ignore unexpected requests to confirm an address or pay a small fee to release a parcel. Those messages will fit this leak exactly.
• Cut back the extra data that sits next to your name and address on people-search sites. A leaked shipping record becomes much more dangerous when it can be joined to listings that add relatives, extra phone numbers, employers, and previous addresses. Those listings, unlike the stolen CEVA file, can actually be taken down through each site’s opt-out process. That is the lever you still have.