Manchester-based drinks company Sneak Energy has notified customers of a security incident at its US analytics provider, TripleWhale, that began on the exact day its official Dungeons & Dragons collaboration launched.
In an email sent to customers on 12 November 2026, the company confirmed that an unauthorised party accessed systems holding Sneak Energy store data between 30 October and 1 November 2026. The breach window started on Friday, 30 October, the same day Sneak Energy opened early access and general sales for its limited-edition Dungeons & Dragons flavours and merchandise.
What data was exposed?
According to Sneak Energy’s notice, TripleWhale alerted the UK firm to the breach on 3 November 2026. The compromised records include customer first and last names, email addresses, phone numbers, mailing addresses, and the total amount each customer has spent with Sneak Energy.
The Sneak Team, in a customer security notice, said;
The personal information involved was your first and last name, email address, phone number, mailing address and the total amount you’ve spent with Sneak Energy. Importantly, there was no access to payment details, order details or passwords.”
Sneak Energy stated that it does not yet know whether the unauthorised party copied or downloaded the information during the 48-hour access window. Because TripleWhale processes e-commerce analytics across the retail sector, Sneak Energy noted that it is one of more than 65,000 companies affected by the incident.
Timing and tabletop connections
The timing creates an awkward overlap for tabletop fans. Sneak Energy, founded in 2018 by Jonny Teeling and Will Peirce, and led by chief executive Ashley Read, has built a strong following among gamers through licensed pop-culture drops. Its Dungeons & Dragons collection, produced with permission from Wizards of the Coast, introduced four themed drinks (Breath Weapon, False Fortune, Brain Juice, and Citrus Quest) alongside a glow-in-the-dark shaker, T-shirt, and hoodie.
That launch weekend also coincided with a busy period for tabletop gaming in Sneak Energy’s home city of Manchester, where the Manchester Board Game Festival ran its Halloween event from 30 October to 1 November.
While Sneak Energy’s direct storefront accounts and payment systems were not breached, the company took nine days to go from receiving TripleWhale’s warning on 3 November to alerting its mailing list on 12 November. The notice does not clarify whether shoppers who ordered during the Dungeons & Dragons launch weekend had their newly entered details synced to TripleWhale in real time, or whether the exposure was limited to existing customer records.
Advice for customers
Because total spend figures and home addresses were exposed alongside contact details, the primary risk to buyers is targeted phishing rather than direct account takeover. Fraudsters often use real purchase histories and delivery addresses to make fake courier texts or refund scams appear legitimate.
Sneak Energy advises customers to ignore unexpected emails, calls, or text messages referencing Sneak, TripleWhale, order numbers, or home addresses, and to type official website addresses directly into a browser rather than clicking links. Customers with questions can contact [email protected] with the subject line “Data incident”.
For fans hesitant to trust the website, you can still buy Sneak Energy from Amazon and UK supermarkets.
