Pokémon Center data breach exposes customer info, cancels some orders

What Changed

The Pokémon Company is notifying UK and German Pokémon Center customers that their data was exposed in a breach at logistics provider CEVA Logistics. The company says the attack began on July 30. CEVA has described an incident running from July 29 to August 1.

Exposed data includes names, addresses, phone numbers, email addresses and order contents. Payment card data was not affected. Some orders were cancelled as a result of the incident.

A Supply Chain Incident, Not A Retailer Breach

Pokémon Center was not breached directly. CEVA, part of shipping group CMA CGM, handles fulfillment for many brands, and Valve was also affected. CEVA says it keeps customer data for up to 90 days, and the attack disrupted eight of its European warehouses.

Why This Is An Operations Problem

Fulfillment partners need names, addresses and order details to do their job, so they hold exactly the data that makes targeted phishing convincing. Customers who receive a message mentioning a real recent order are more likely to trust it.

What To Verify First

• List the logistics, fulfillment and customer-service providers that hold your customer data, and how long they keep it.
• Check contracts for breach-notification timelines and data-retention limits.
• Prepare customer guidance on order-themed phishing if a provider reports a breach.
• Confirm your incident plan covers breaches at third parties, including who notifies customers and regulators.

What Teams May Be Underestimating

Retention is the hidden variable, and it is rarely reviewed after a contract is signed. A 90-day window at a logistics partner means one breach can expose months of orders across many brands at once.

Source Context

This item was rebuilt from the following primary sources and original reporting:

• BleepingComputer: Pokémon Center data breach exposes customer info, cancels some orders

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

New SynkLoader malware pushed in Microsoft Teams phishing campaign

Expel says the campaign uses Microsoft Teams messages to push a fake "PowerShell Cleaner" MSI from Azure, then drops a…

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA's latest KEV update is only useful if it changes what defenders do next. This one adds three actively exploited…

Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Unit 42 described three post-compromise attack paths against Chrome's Google Password Manager on Windows that could let malware bypass user-verification…