Sneak Energy breach: customer names, contact details and spending totals may have been accessed through analytics provider TripleWhale

What happened

Sneak Energy, the Manchester-based drinks company, emailed its customers on November 12, 2026 about a security incident at TripleWhale, the US e-commerce analytics provider that processes its store data. An unauthorised party accessed systems holding Sneak Energy store data between October 30 and November 1, 2026. TripleWhale alerted Sneak to the breach on November 3, and Sneak says it does not yet know whether the intruder copied or downloaded the information during the access window — which is why this report is labelled POTENTIAL EXPOSURE. The notice adds that Sneak is one of more than 65,000 companies affected by the TripleWhale incident, a provider-wide figure given in the company’s own notice. The access window opened on October 30, the same day Sneak opened sales for its licensed Dungeons & Dragons drink range. The window and the data fields match the incident Who Gives A Crap disclosed on November 7, which that company attributed to an unnamed marketing-software provider; Who Gives A Crap did not name its provider, so whether the two notices describe the same provider incident has not been confirmed. The systems accessed were TripleWhale’s, not Sneak’s own storefront.

Who is affected

The people affected are Sneak Energy customers whose store data TripleWhale held. The company’s notice lists the personal information involved: first and last names, email addresses, phone numbers, mailing addresses and the total amount each customer has spent with Sneak Energy. Sneak has not published how many of its customers that covers. The notice is equally plain about what was not reached: “there was no access to payment details, order details or passwords.” One question the notice does not answer is whether details entered by shoppers during the October 30 to November 1 launch weekend had already been passed to TripleWhale in that window, or whether the exposure is limited to customer records the provider already held — customers who ordered that weekend should assume their details may be in the set until the company says otherwise.

How serious

The concrete risk is targeted phishing, not direct theft. With no passwords and no payment details in the set, this data alone does not open a Sneak account or charge a card. What it does supply is credibility: a name, a home address, a phone number and a real total-spent figure are the ingredients of a fake courier text, a fake refund offer or a fake “problem with your delivery” call that sounds like the genuine company because every checkable detail in it is true. The total-spent figure is the unusual ingredient — most breach sets cannot tell a scammer which customers are worth the most effort, and this one can. The harm, if it comes, arrives as a message that persuades the customer to hand over the card details or code the breach itself did not contain.

What to do now

Sneak Energy’s own advice to customers is to ignore unexpected emails, calls or text messages referencing Sneak, TripleWhale, order numbers or home addresses, and to type the official website address directly into a browser rather than clicking links in messages. Follow it literally: if a message about a delivery or a refund asks you to enter card details or pay a fee, it is asking for the one thing this breach did not give the scammers, and the request itself is the tell. To check an order or your account, go to Sneak’s official site yourself. The notice gives customers a dedicated contact route for questions, using the subject line “Data incident”. If TripleWhale or Sneak later confirms whether the data was copied, or publishes a customer count, this report will be updated.

Sources: GeekNative, “Dungeons & Dragons partner Sneak Energy reports customer data breach starting on launch day,” November 12, 2026 (reporting Sneak Energy’s November 12 customer notice)