Pokémon Center account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Pokémon Center’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
August 2026: customer data taken at a shipping partner, not at Pokémon Center
If you got an email from Pokémon Center about a data breach or a cancelled order, it is about a break-in at a delivery partner rather than at the store. Press coverage from August 17 and 18, 2026 ties it to the intrusion at CEVA Logistics, the contract logistics provider that packs and ships Pokémon Center orders in Europe. Names, postal addresses, phone numbers, email addresses and the contents of orders were reported as taken; payment card details and account passwords were not. That means there is nothing to reset at Pokémon Center, and the thing to actually guard against is a delivery message that quotes your real order back at you.
BleepingComputer (17 August 2026), Forbes, TechRadar and Security Magazine (18 August 2026)
If your Pokémon Center account was hacked: start recovery at the official page (support.pokemoncenter.com/hc/en-us), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Pokémon Center account, step by step
These steps follow Pokémon Center’s official process. Official links only: account recovery · password reset.
Check the order itself from your own account rather than from the email: open pokemoncenter.com the way you normally would and look at Order Status, where a real cancellation shows up.
If you want the incident confirmed for your order, ask through Pokémon Center Support rather than by replying to the message, and expect the answer to be about the third-party provider rather than about the store.
Do not reset anything at Pokémon Center because of this, but do turn on multi-factor authentication for the Pokémon Trainer Central account behind the store and for the email address the account uses.
If the same password protects that email or any shopping account, change it there, since the leaked address and name make targeted guessing easier even when no password was involved.
Treat delivery and refund messages about Pokémon Center orders as unverified for the next few months, however accurate they sound, and report attempts at reportfraud.ftc.gov so the pattern is on record.
What trips people up with Pokémon Center
- The cancellation email is the confusing part, because the version quoted in press coverage blamed "an unforeseen fulfilment issue" and said nothing about a breach. A cancelled order is therefore not a reliable signal either way: some people had orders cancelled and a separate notification, and a cancellation on its own does not tell you whether your details were in the file.
- What was taken is exactly the raw material for a convincing delivery scam. Someone with that file knows the plush or the TCG box you ordered, the price, the address it was going to and the phone number attached, so a "your parcel could not be delivered, confirm your address" message will quote real facts at you. Accurate details prove the sender has the file and nothing else.
- There is no password to reset at Pokémon Center, but the login behind the store is a Pokémon Trainer Central account that also covers the games and the TCG apps, and that email address is now circulating next to your home address. Turning on multi-factor authentication there is worth doing anyway, on the account and on the mailbox behind it.
- Watch for the refund and reorder variant as well. A cancelled order plus a stolen order list is a ready-made script for "we could not process your refund, re-enter your card", and it arrives while you are genuinely waiting for money back. Refunds go back to the payment method by themselves; nobody needs your card number to return your own money.
What happened to Pokémon Center customer data in August 2026
Between 29 July and 1 August 2026 somebody got into the systems of CEVA Logistics, the contract logistics operator that stores stock and ships orders for a long list of European retailers, Pokémon Center among them. Pokémon Center began writing to customers in the middle of August to say their details had been exposed through that third party, and cancelled a batch of pending orders at the same time. BleepingComputer reported the notices on 17 August 2026, with Forbes, TechRadar, Security Magazine and SC Media UK following the next day. The store itself was not broken into, and no Pokémon Center system was reported as compromised.
The split between what went and what stayed is the useful part. Reported as taken: full name, mailing address, phone number, email address, and details of what was in the order. Reported as untouched: payment card details, which the shipper never receives, and account passwords and login credentials, which never travel to a logistics provider in the first place. So this is not an account-takeover story and there is no password you need to change because of it. It is a phishing story, because the people holding that file know what you bought, what it cost, where it was going and how to reach you.
The notices reported so far went to buyers in the United Kingdom and Germany, and no announcement about United States customers has followed. That gap matters if you are in the US and arrived here from a headline: the absence of a letter is genuinely the state of things rather than a delay you can read anything into, and there is no tool that can check it for you, because nothing from this incident has been published as a searchable set of records. The same CEVA break-in is behind the emails Valve sent to European Steam hardware buyers and the notices from Bol and De Bijenkorf, so the pattern is a warehouse, not a brand.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Pokémon Center's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from Pokémon Center?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Pokémon Center). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
Locked out of Pokémon Center — email or phone was changed
This is the worst-case scenario and the most common complaint: the attacker changed the account email, phone number or password so the normal reset flow emails them, not you. Do NOT keep triggering password resets — they go to the hacker. Go straight to Pokémon Center's dedicated recovery flow (link above), which is built for exactly this case: it verifies you by your original signup details, previous passwords, linked devices or a government ID / selfie check, bypassing the stolen email. Watch for the security notice Pokémon Center sent to your OLD email when the address was changed — it usually contains a "revert this change" link that works for a limited time and is the fastest way back in.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Pokémon Center (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Pokémon Center itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Pokémon Center account, answered
How did my Pokémon Center account get hacked?
The most common cause isn't a hack of Pokémon Center itself — it's credential stuffing: a password you used on Pokémon Center leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Pokémon Center login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Pokémon Center account back?
Usually yes. Use the official recovery flow (https://support.pokemoncenter.com/hc/en-us) — it can verify you even when the attacker changed the email and password. Be patient and respond quickly to follow-ups so the case stays open.
Should I just make a new Pokémon Center account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Pokémon Center can lock it, before you start over.
The hacker placed orders or drained gift cards on my Pokémon Center account — now what?
Report the orders as unauthorized through Pokémon Center's support, dispute any card charges with your bank, and check saved addresses and payment methods for ones the attacker added. Loyalty points and gift-card balances are a favorite target because people don't watch them like a bank account — screenshot balances and include them in the report.
Was Pokémon Center itself hacked?
No. Press coverage from 17 and 18 August 2026 traces the exposure to CEVA Logistics, the contract provider that stores and ships Pokémon Center orders in Europe. The store’s own systems were not reported as compromised, which is why the notice talks about a third party.
Did my Pokémon Center password leak?
No, and there is nothing here to reset. A shipping provider gets what is needed to deliver a parcel: who you are, where it goes and what is in the box. Passwords and login credentials never reach the shipper, and the notices say so explicitly.
I am in the US. Was I affected by the Pokémon Center breach?
Nothing announced so far covers US buyers. The notices reported by the press went to customers in the United Kingdom and Germany. No searchable record set from this incident has been published, so no checking tool can answer it for you, and a letter or email from the store remains the only confirmation.
Why was my Pokémon Center order cancelled?
The cancellations came alongside the incident at the shipping provider, whose European warehouses were disrupted for several days. The wording quoted in coverage referred to a fulfilment issue rather than to the breach, so a cancelled order by itself does not tell you whether your data was involved.
Were my card details taken in the Pokémon Center breach?
Nothing reported so far includes payment card numbers, and a logistics provider has no reason to hold them: the card is handled by the retailer and its payment processor while the parcel label carries an address. What did come out is the order contents and the price, which is enough for a convincing fake payment message without a card number behind it.
Is the email about my cancelled Pokémon Center order genuine?
It may well be, because the store did write to customers in August 2026. Do not judge it by how it looks, since whoever holds the stolen order list can write a better one. Open your order history from the site yourself, without touching any link in the message, and see whether the cancellation is there.
How do I stop my Pokémon Center account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.