Pokémon Center has begun notifying customers in the United Kingdom and Germany that a cyberattack on one of its shipping partners exposed their personal and order information. The breach hit CEVA Logistics — a subsidiary of CMA CGM, the world’s third-largest shipping company — which Pokémon Center uses to fulfill and deliver orders placed on PokemonCenter.com. Because CEVA handles the logistics, the data stored in its systems included names, shipping addresses, and order details submitted by customers at the time of purchase.
The attack disrupted eight of CEVA’s European warehouses, causing shipping delays and forcing Pokémon Center to cancel some orders that could not be fulfilled. CEVA has told at least one affected company that it retains delivery-related information for up to 90 days after an order ships. Pokémon Center has not said how many customers received breach notices or when the CEVA incident occurred, and CEVA has not publicly confirmed the scope of data accessed.
How to check if you’re affected
Affected products are any orders placed through PokemonCenter.com and shipped to addresses in the United Kingdom or Germany. If you placed an order on PokemonCenter.com for delivery to either country, you may receive a breach notification email from Pokémon Center. Check for that email and monitor your inbox for phishing attempts referencing your order history, as stolen order details are often used to craft convincing follow-up scams.