CEVA Logistics cyberattack forces Pokémon Center order cancellations

A cyberattack on CEVA Logistics, a major third-party logistics provider for Pokémon Center in Europe, has forced the cancellation of pending orders in the United Kingdom and Germany, including pre-orders for the highly sought-after Pokémon TCG 30th Celebration expansion. The breach, which began around July 29-30, 2026, compromised customer personal data including names, addresses, phone numbers, and email addresses across multiple CEVA clients including Valve's Steam hardware operations, indicating systemic vulnerabilities affecting multiple retailers. For supply chain professionals, this incident underscores a critical vulnerability in outsourced logistics operations: third-party breaches can trigger immediate operational disruptions and order cancellations rather than mere delays.

The fact that CEVA serves eight European warehouses across multiple retail clients suggests that single-vendor dependency in regional logistics creates concentrated risk exposure. The decision to cancel orders outright rather than implement shipping delays raises questions about data integrity concerns or system-wide operational paralysis that extended beyond the breach itself. The incident highlights the necessity for supply chain teams to establish comprehensive third-party risk assessment protocols, including cybersecurity audit requirements, incident response plans with tiered escalation procedures, and contractual obligations for breach transparency and operational continuity.

Organizations relying on similar third-party fulfillment models should audit their current vendor security posture and develop backup fulfillment strategies to mitigate single-point-of-failure risks in critical retail periods.