The Pokémon Company has cancelled orders for its Pokémon 30th Anniversary Cards after a "cyber incident" exposed customer data, according to emails shared by affected fans who had pre-ordered the trading cards through the Pokémon Center website. The breach appears limited to European orders fulfilled by logistics firm CEVA, the same provider recently linked to a data theft affecting Valve customers who had bought Steam hardware, suggesting the incidents may be connected.

The Pokémon Company confirmed that unauthorised parties may have obtained customers' full names, mailing addresses, phone numbers, email addresses and order contents from CEVA. It remains unclear how many customers have been affected or why orders were fully cancelled, unlike Valve's response to its own breach. The news adds to ongoing difficulties around Pokémon card scarcity, with measures such as box-slicing at US retailer Target and facial recognition checks in Japan already in place to curb scalping, despite roughly 10 billion cards being printed last year.