Incident BriefingsSnow Peak community-app intrusion

Snow Peak community-app intrusion

Snow Peak identified community-app data leakage November 10 after unauthorized access on October 30 and November 8–9. It attributed access to an application vulnerability.

Last modified

Summary

  • Environment: Community application
  • Operational impact: Temporary service suspension during security response
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 14, 2026; updated as evidence emerges.

What happened

Snow Peak identified community-app data leakage November 10 after unauthorized access on October 30 and November 8–9. It attributed access to an application vulnerability. [1]

Impact

The affected population was 21,553 people. Potentially exposed fields were membership numbers, display names, self-introductions and cover images. Addresses, phone numbers, email addresses, passwords and card information were excluded. [1]

Timeline

  1. First reported community-app access

    First reported community-app access.

    [1]

  2. Further access period begins

    Further access period begins.

    [1]

  3. Community-data leakage identified

    Community-data leakage identified.

    [1]

  4. Incident and response disclosed

    Incident and response disclosed.

    [1]

  5. Briefing updated

    This briefing was last reviewed and updated on November 14, 2026.

Threat Group & Attack Vector

Snow Peak attributed this intrusion to a vulnerability but did not identify a CVE or specific exploit. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific ATT&CK technique is mapped from the available evidence.

Response

Snow Peak temporarily suspended the affected services and strengthened security and monitoring. Its November 13 notice planned a store restart that day, with other services awaiting security measures. It had not confirmed secondary harm. [1]