As reported by BleepingComputer, Pokémon Center is notifying UK and Germany customers that personal and order data was stolen in a breach at CEVA Logistics — a subsidiary of CMA CGM Group and one of the world's largest third-party logistics providers. The same incident also compromised Valve's Steam hardware customers in Europe. This is not a story about Pokémon or Valve being hacked; it is a story about systemic third-party risk in the logistics supply chain.

Key Takeaway: As reported by BleepingComputer, Pokémon Center is notifying UK and Germany customers that personal and order data was stolen in a breach at CEVA Logistics — a subsidiary of CMA CGM Group and one of the world's largest third-party logistics providers.

The Real Story: Concentration Risk in Logistics

CEVA operates over 1,000 warehouses and handled 15 million shipments last year. When a provider at that scale is breached, the blast radius is enormous — and we likely have not yet seen the full list of affected retailers. Pokémon Center and Valve are simply the first to send notifications. Any organization that shared customer PII with CEVA for European fulfillment between late July and early August 2026 should assume their data is in scope.

The attack window of July 29–August 1 is narrow, but CEVA's 90-day data retention policy means any customer data passed to the logistics provider in the preceding three months is potentially exposed — not just orders placed during the attack window itself.

Why Logistics Providers Are Prime Targets

The Real Story: Concentration Risk in Logistics
Rich PII datasets: Name, address, phone, email, and purchase history — enough for highly credible phishing, identity fraud, and physical security threats.
Thin security margins: Logistics operates on tight margins with high operational pressure, often underinvesting in security compared to the brands they serve.
Operational disruption leverage: Eight warehouses were disrupted, causing shipping delays. Attackers know that operational downtime in logistics creates immediate financial pressure and may increase ransom willingness.
Multi-tenant exposure: A single breach yields data from dozens of retailers simultaneously — high ROI for attackers.

The Data Minimization Gap

One detail deserves more attention than the original coverage gives it: CEVA retains delivery-related information for up to 90 days post-delivery. That retention window directly determined the breach scope. Many retailers share full customer records with fulfillment partners without negotiating shorter retention, field-level data minimization, or encryption-at-rest requirements. This breach is a case study in why data minimization clauses in vendor contracts are not just compliance checkboxes — they are breach scope controls.

Notably, payment card data was not exposed because CEVA never had it. That is data minimization working as intended for one data category. The same principle should have been applied more aggressively to shipping data — does a warehouse need a customer's phone number and email, or just a shipping label?

Shield53 Recommendations

For Retailers Using Third-Party Logistics

  • Audit your vendor data flow: Map exactly what PII fields are transmitted to each fulfillment partner and challenge whether each field is operationally necessary.
  • Renegotiate retention clauses: Push for 30-day or shorter retention with automated deletion. 90 days is excessive for post-delivery records.
  • Require breach notification SLAs: Contractual notification within 24–72 hours of vendor incident detection — not weeks later.
  • Implement tokenization: Where possible, use tokenized or pseudonymized customer identifiers instead of raw PII in fulfillment systems.
  • Diversify critical vendors: Concentration risk at a single logistics provider means a single breach cascades. Maintain secondary fulfillment paths for critical markets.

For Affected Customers

  • Be alert for targeted phishing referencing Pokémon Center or Steam hardware orders — attackers now have enough context to craft convincing messages.
  • Monitor for unexpected package intercept attempts or address-change requests using exposed contact details.
  • Consider whether your phone number and address combination has appeared in other breaches; this dataset adds another layer for identity fraud.

For Security Teams — Detection

  • Review any API integrations or SFTP connections to CEVA systems for credential exposure.
  • Check endpoint and network logs for July 29–August 1 for any indirect indicators of compromise via partner-connected systems.
  • If your organization shared data with CEVA in the past 90 days, preemptively prepare breach notification workflows even if you have not yet been informed.

This incident should prompt every CISO with third-party fulfillment dependencies to ask one question at their next leadership meeting: If our logistics provider were breached today, how many of our customers' records would be exposed, and how quickly would we know? If the answer is uncertain, the vendor risk program has a gap.