Sneak Energy confirmed a customer data breach on 12 November 2026 at TripleWhale, its US analytics provider. Access from 30 October to 1 November 2026 exposed first and last names, email addresses, phone numbers, mailing addresses and total spend. Payment details, order details and passwords were not accessed.
Sneak Energy's own storefront and payment systems were not breached, and the company has not disclosed how many of its customers were affected. Sneak Energy is a Manchester energy drinks company founded in 2018 by Jonny Teeling and Will Peirce and led by chief executive Ashley Read. The access window opened on 30 October 2026, the same day the company opened early access and general sales for its limited-edition Dungeons & Dragons collection of themed drinks and merchandise, produced with permission from Wizards of the Coast. The notice reached customers by email, and its wording is known through verbatim quotes carried by Geek Native, which reported the breach on 12 November 2026.
Data taken in the breach#
The customer notice listed five categories of personal information and three exclusions. The notice, quoted by Geek Native, stated:
"The personal information involved was your first and last name, email address, phone number, mailing address and the total amount you've spent with Sneak Energy. Importantly, there was no access to payment details, order details or passwords."
| Data type | Exposed |
|---|---|
| First and last name | Yes |
| Email address | Yes |
| Phone number | Yes |
| Mailing address | Yes |
| Total amount spent with Sneak Energy | Yes |
| Payment details | No |
| Order details | No |
| Passwords | No |
The exposed fields combine into a set that supports impersonation. A name, an email address, a phone number and a home address together allow a message to quote details that match the recipient's real records, and a total spend figure can be quoted to make a fraudulent refund or delivery message match the recipient's spending with Sneak Energy. The mechanism is described in guidance on how phishing uses a leaked email address, which explains how exposed contact details are used to build messages that appear to come from a company the recipient already buys from. The exposure does not allow direct account takeover, because no passwords were exposed, and it does not allow money to be taken directly, because no payment details were exposed. The data can be used to gain trust before a request for payment details or login credentials.
Breach timeline#
On 30 October 2026, an unauthorised party gained access to systems holding customer data at TripleWhale. On the same day, Sneak Energy opened early access and general sales for its Dungeons & Dragons collection, a range of four themed drinks alongside a glow-in-the-dark shaker, T-shirt and hoodie. The launch date of 30 October had been reported by Stack3d on 28 October, and the Halloween collaboration was covered by Asian Trader the same day.
On 31 October 2026, the provider identified the intrusion. On 1 November 2026, the provider secured its systems, closing the access window after about 48 hours. Those two dates come from the public incident notice published by Who Gives A Crap, a second company affected by the same TripleWhale incident, which recorded that access began on 30 October, was identified on 31 October and was secured on 1 November.
On 3 November 2026, TripleWhale alerted Sneak Energy to the breach. On 6 November 2026, the same provider alerted Who Gives A Crap, which published its own incident notice on 7 November. On 12 November 2026, Sneak Energy emailed its customers with the details. Nine days passed between TripleWhale's alert to Sneak on 3 November and Sneak's customer email on 12 November, and no reason for that gap has been stated.
TripleWhale and the vendor scope#
TripleWhale is a United States analytics provider for e-commerce businesses, and it processes store data for retailers. One intrusion into its systems therefore reached customer records belonging to many separate companies at once. Sneak Energy noted in its notice that it is one of more than 65,000 companies affected by the incident. That figure counts companies on the TripleWhale side, and it is not a count of Sneak Energy customers, for which no figure has been disclosed.
Who Gives A Crap provides an independent check on the same incident. Its public notice, published 7 November 2026, describes the same access window, the same five categories of exposed data and the same three exclusions, and it states that the company does not know whether the information was copied or downloaded. Who Gives A Crap did not name the provider in its notice, and its Canadian customers were not affected, according to the provider. The company disconnected the provider from its systems and changed access credentials. The full notice is published on the company's site at Who Gives A Crap, and The Register covered the notice on 9 November 2026.
Measures stated for affected customers#
Sneak Energy advised customers to ignore unexpected emails, calls or text messages referencing Sneak, TripleWhale, order numbers or home addresses, and to type official website addresses directly into a browser rather than clicking links in messages. Customers with questions can contact [email protected] with the subject line "Data incident". No password change is needed for a Sneak Energy account because of this incident, and no payment card needs to be cancelled on the basis of this breach alone, because no passwords or payment details were exposed.
The same guidance applies in general terms to any breach that exposes an email address. Affected customers can check whether the address appears in other known breaches through Have I Been Pwned, and guidance on what to do when an email address is in a data breach covers the password work: if the same password was used on the Sneak account and on any other service, the password should be changed on those other services, because the exposed email address makes credential stuffing attempts against other accounts more likely. Messages that quote a real home address or a real spend total deserve extra care, because those details are the ones that make a phishing message convincing.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Questions still open#
Several facts remain unknown. Sneak Energy stated that it does not yet know whether the unauthorised party copied or downloaded the information during the access window. The notice does not clarify whether shoppers who ordered during the Dungeons & Dragons launch weekend had their newly entered details synced to TripleWhale in real time, or whether the exposure was limited to existing customer records. The launch weekend was the busiest sales period in the window. Customers who bought then are the ones most likely to expect genuine messages from Sneak Energy in the days after.
No attack vector has been disclosed, and no attacker or group has been identified or has claimed responsibility. No public statement from TripleWhale itself was found at the time of writing, so the vendor's own account of how the access happened and how many records were involved is still missing. No regulator notification by Sneak Energy has been reported, and no evidence of misuse of the data, or of the data appearing for sale, has been reported either. The Register's coverage of the Who Gives A Crap notice, published 9 November 2026, confirms the same gaps on the other affected company's side: the provider was unnamed there and no customer count was given.
AliasFleet and leaked email addresses#
AliasFleet provides one email alias per service, so each website a customer signs up to receives a different address that forwards to the same inbox. When a vendor breach exposes the address a customer gave to one service, the exposed address identifies that service as the source, and the alias can be paused or deleted without changing the address used anywhere else. AliasFleet does not prevent a vendor breach, and it does not remove an address from a file an attacker already holds. What it changes is the next step: the exposed address cannot be reused to impersonate the customer at other services, because no other service has that address.
The exposed data came from a vendor the customer never signed up with directly, and the customer has no control over that vendor's security. The address handed to Sneak Energy was the single point of contact the vendor held, and it is now in the hands of an unauthorised party alongside a name, a phone number and a home address. A separate alias per service keeps that exposure contained to one service.
The confirmed facts are the window, the data types, the exclusions and the dates of the alerts. TripleWhale has not published its own account, Sneak Energy has not given a customer count, and whether the data was copied remains unknown. Customers who received the 12 November email should treat unexpected messages quoting their Sneak Energy details with care and contact the company through the address given in the notice.
