Loading story…
Pokémon Center told customers in the United Kingdom and Germany that personal and order information was exposed after a cyberattack on CEVA Logistics, the third-party shipping provider handling deliveries in those countries. The attackers reportedly breached CEVA systems between late July and early August, exposing customer names, mailing addresses, phone numbers, email addresses, and order contents. Payment card data and Pokémon Center account information were not affected, as CEVA did not have access to that information.
The intrusion also disrupted fulfillment operations, causing shipping delays and the cancellation of some Pokémon Center orders. CEVA said the attack affected part of its European contract logistics environment and disrupted at least eight warehouses across Europe, with reports indicating other retailers were also impacted. Dutch data protection authorities and law enforcement are investigating, underscoring the wider supply-chain risk created when logistics providers are compromised.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
On August 1, 2026, CEVA Logistics told affected customers that a cyber intrusion was impacting part of its European contract logistics operations. CEVA said the operational impact was contained to eight sites and no other global CEVA systems were affected.
Attackers breached CEVA Logistics servers between July 29 and August 1, 2026. The incident affected multiple European retailers and disrupted part of CEVA's European contract logistics operations.
CEVA Logistics informed affected parties that it was the victim of a cyberattack beginning on July 30, 2026. The attack impacted systems used to process delivery information for retail clients.
CEVA Logistics said the intrusion most likely began on July 29, 2026, preceding the broader disruption to its European logistics operations.
Dutch data protection authorities and other law enforcement agencies opened investigations into the CEVA Logistics incident. The company had not publicly disclosed the attack vector or attributed the intrusion to a threat actor.
Pokémon Center posted a UK website notice warning that some orders would take longer to process, dispatch, and deliver, and breach notification emails said some recent orders were canceled due to an unforeseen fulfillment issue. Customers reported both delays and cancellations tied to the CEVA incident.
Pokémon Center notified customers in the United Kingdom and Germany that their personal and order information may have been exposed through CEVA Logistics, its shipping provider in those countries. Exposed data may have included names, mailing addresses, phone numbers, email addresses, and order contents, while payment card data was not affected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
rhisac.org
Open sourcesecuritymagazine.com
Open sourceteiss.co.uk
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Valve has notified European customers who bought Steam hardware that personal delivery and order data was likely stolen after a cyberattack on shipping partner **CEVA Logistics**. The company said attackers had access to CEVA servers between **July 29 and August 1, 2026**, exposing names, addresses, phone numbers, email addresses, and the type and price of ordered products tied to Steam hardware shipments, including older purchases such as Steam Machines and Steam Controllers. Valve said the breach was limited to fulfillment data held by CEVA and did **not** expose Steam account credentials, payment card information, or **Steam Guard** codes. The company warned affected customers to expect phishing emails, text messages, and phone calls impersonating Valve, Steam, or delivery firms, including scams requesting customs or delivery fees or login details. CEVA said it isolated affected systems, notified data protection authorities, and brought in external investigators after the attack also disrupted operations at eight European warehouses.
Aug 16, 2026
Dutch retailer **Bol** warned customers that some personal information may have been viewed or copied after unauthorized parties accessed systems at **CEVA Logistics**, a logistics partner that processes and delivers orders from one of Bol’s distribution centers. Bol said its own environment was not compromised, but customer data linked to the partner’s operations was affected, and reports indicated the stolen information was being offered for sale on the dark web. The disclosure followed a similar warning from **De Bijenkorf**, which also linked its incident to a logistics partner and said the breach likely affected customer data. Reporting suggested the two cases are related, pointing to a broader third-party supply-chain compromise centered on CEVA Logistics, with De Bijenkorf also experiencing order-processing delays as the incident disrupted operations.
Aug 7, 2026
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026