Manchester-based drinks company Sneak Energy has told customers that their personal details were exposed in a security incident at its US analytics provider, TripleWhale. The breach window ran from 30 October to 1 November 2026, the same weekend Sneak opened sales for its official Dungeons & Dragons collection.

TripleWhale alerted Sneak to the incident on 3 November. In an email sent to customers on 12 November, Sneak confirmed that an unauthorised party accessed systems holding its store data. The exposed records include customer first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent with Sneak.

What was not exposed

Sneak said there was no access to payment details, order details or passwords, and that its own storefront accounts and payment systems were not breached. The company said it does not yet know whether the data was copied or downloaded during the 48-hour window.

Because TripleWhale processes e-commerce analytics across the retail sector, Sneak noted that it is one of more than 65,000 companies affected by the incident. The Dungeons & Dragons collection, produced with permission from Wizards of the Coast, introduced four themed drinks — Breath Weapon, False Fortune, Brain Juice and Citrus Quest — alongside a glow-in-the-dark shaker, T-shirt and hoodie.

Customers warned over phishing risk

With home addresses and purchase histories exposed alongside contact details, the main risk to buyers is targeted phishing rather than direct account takeover. Fraudsters can use real order histories and delivery addresses to make fake courier texts or refund scams look genuine.

Sneak advises customers to ignore unexpected messages mentioning Sneak, TripleWhale, order numbers or home addresses, and to type official website addresses directly into a browser rather than clicking links. Customers with questions can email [email protected] with the subject line “Data incident”.