What Changed
The Pokémon Company is notifying UK and German Pokémon Center customers that their data was exposed in a breach at logistics provider CEVA Logistics. The company says the attack began on July 30. CEVA has described an incident running from July 29 to August 1.
Exposed data includes names, addresses, phone numbers, email addresses and order contents. Payment card data was not affected. Some orders were cancelled as a result of the incident.
A Supply Chain Incident, Not A Retailer Breach
Pokémon Center was not breached directly. CEVA, part of shipping group CMA CGM, handles fulfillment for many brands, and Valve was also affected. CEVA says it keeps customer data for up to 90 days, and the attack disrupted eight of its European warehouses.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why This Is An Operations Problem
Fulfillment partners need names, addresses and order details to do their job, so they hold exactly the data that makes targeted phishing convincing. Customers who receive a message mentioning a real recent order are more likely to trust it.
What To Verify First
- List the logistics, fulfillment and customer-service providers that hold your customer data, and how long they keep it.
- Check contracts for breach-notification timelines and data-retention limits.
- Prepare customer guidance on order-themed phishing if a provider reports a breach.
- Confirm your incident plan covers breaches at third parties, including who notifies customers and regulators.
What Teams May Be Underestimating
Retention is the hidden variable, and it is rarely reviewed after a contract is signed. A 90-day window at a logistics partner means one breach can expose months of orders across many brands at once.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
