Pokémon 30th Anniversary Card Orders Canceled After Logistics Partner Data Breach

The Pokémon Company has canceled orders for its Pokémon 30th Anniversary cards following a cyber incident at its shipping partner, according to notices sent to affected customers. It turns out the road to catching 'em all now involves dodging data leaks, proving that supply chain security is the one boss fight no one was prepared for.

The disruption stems from a data breach at CEVA Logistics, a third-party logistics firm handling distribution in Europe. If that name sounds familiar, it is because the exact same logistics partner recently made headlines for exposing the shipping details of Valve's Steam hardware customers. Customers in the UK and Germany have received warnings from The Pokémon Company advising them that their personal information may have been exposed in the breach.

Finding out your shiny anniversary cards are canceled because a shipping company got hacked is the logistical equivalent of buying a gym membership in February only to find out the gym has been replaced by a bakery. It is a reminder that the modern gaming ecosystem relies on a delicate web of third-party partners, where a leak in one pipe quickly floods everyone's basement.

The details

• Affected items: Pokémon 30th Anniversary cards (orders canceled)
• The cause: Cyber incident at logistics partner CEVA Logistics
• Impacted regions: United Kingdom and Germany
• Other victims: Valve Steam hardware customers in Europe

A shared shipping lane

The breach has drawn a straight line between two of the most disparate names in gaming. When CEVA Logistics slipped up, it did not just affect those waiting for collectible pocket monsters; it also hit Valve's European hardware deliveries. It is an unusual cross-over episode where Steam Deck enthusiasts and card collectors find themselves in the exact same frustrating boat.

For Valve customers, the breach meant shipping details for Steam Decks and Index VR kits were laid bare. For Pokémon collectors, it meant a direct cancellation of highly anticipated card orders. The common denominator is a single logistics partner, proving that in the digital age, a gaming giant's security is only as strong as the warehouse company printing its shipping labels. It is a group project where one partner forgot their part of the slides, and everyone's grade took a hit.

What was exposed

According to warning emails sent to customers in the UK and Germany, the compromised data contains personal information used for shipping. While The Pokémon Company has not detailed the full extent of the compromised data fields, the immediate fallout is clear: orders for the highly anticipated 30th Anniversary cards are being wiped from the system to contain the risk.

For those affected, there is no option to simply wait for a delayed shipment. The orders are gone, leaving collectors to empty-handed disappointment and the unenviable task of checking their credit monitoring services instead of their mailboxes. It is an abrupt halt to a celebration that was meant to honor decades of fandom.

Why it matters

This incident highlights the growing vulnerability of the physical games industry's supply chain. As major publishers outsource delivery, warehousing, and fulfillment to global logistics conglomerates, a single security failure can compromise multiple competitive companies at once. For players, it is a stark reminder that buying a physical product online does not just mean trusting the logo on the box, but also trusting every truck, warehouse, and database that touches it along the way. In the end, the ultimate rare pull of the 30th anniversary might just be keeping your personal data to yourself.