---
title: "Snow Peak community-app intrusion"
description: "Snow Peak identified community-app data leakage November 10 after unauthorized access on October 30 and November 8–9. It attributed access to an application vulnerability."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-14"
canonical_url: "https://www.ally.security/incidents/snow-peak-community-app-intrusion-2026"
markdown_url: "https://www.ally.security/incidents/snow-peak-community-app-intrusion-2026.md"
stix_url: "https://www.ally.security/incidents/snow-peak-community-app-intrusion-2026/stix.json"
---

# Snow Peak community-app intrusion

Snow Peak identified community-app data leakage November 10 after unauthorized access on October 30 and November 8–9. It attributed access to an application vulnerability.

Last modified Nov 14, 2026 · 1 source

## Summary

- **Environment:** Community application
- **Operational impact:** Temporary service suspension during security response
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Snow Peak](https://www.snowpeak.co.jp/) identified community-app data leakage November 10 after unauthorized access on October 30 and November 8–9. It attributed access to an application vulnerability. [1](#source-1)

## Impact

The affected population was 21,553 people. Potentially exposed fields were membership numbers, display names, self-introductions and cover images. Addresses, phone numbers, email addresses, passwords and card information were excluded. [1](#source-1)

## Timeline

### October 30, 2026 — First reported community-app access

First reported community-app access. [1](#source-1)

### November 8, 2026 — Further access period begins

Further access period begins. [1](#source-1)

### November 10, 2026 — Community-data leakage identified

Community-data leakage identified. [1](#source-1)

### November 13, 2026 — Incident and response disclosed

Incident and response disclosed. [1](#source-1)

### November 14, 2026 — Briefing updated

This briefing was last reviewed and updated on November 14, 2026.

## Threat Group & Attack Vector

Snow Peak attributed this intrusion to a vulnerability but did not identify a CVE or specific exploit. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific ATT\&CK technique is mapped from the available evidence.

## Response

Snow Peak temporarily suspended the affected services and strengthened security and monitoring. Its [November 13 notice](https://www.snowpeak.co.jp/news/p20261113-0/) planned a store restart that day, with other services awaiting security measures. It had not confirmed secondary harm. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/snow-peak-community-app-intrusion-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Snow Peak notice of four online-service incidents

official · Snow Peak Inc. · Nov 13, 2026

<https://www.snowpeak.co.jp/news/p20261113-0/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Disclosed At · 100% confidence · current**  
   Snow Peak community-app intrusion: 2026-11-13
2. **Resulted In · 100% confidence · current**  
   Snow Peak community-app intrusion: Snow Peak temporarily stopped the affected services, strengthened security and monitoring, and was reporting to relevant authorities. On November 13 it announced a store restart planned that day; the other services awaited security measures. It had not confirmed secondary harm.
3. **Resulted In · 100% confidence · current**  
   Snow Peak community-app intrusion: Community-data leakage identified
4. **Resulted In · 100% confidence · current**  
   Snow Peak community-app intrusion: Snow Peak identified community-app data leakage November 10 after unauthorized access on October 30 and November 8–9. It attributed access to an application vulnerability.
5. **Affected Organization · 100% confidence · current**  
   Snow Peak community-app intrusion: Snow Peak Inc.
6. **Resulted In · 100% confidence · current**  
   Snow Peak community-app intrusion: Incident and response disclosed
7. **Resulted In · 100% confidence · current**  
   Snow Peak community-app intrusion: First reported community-app access
8. **Resulted In · 100% confidence · current**  
   Snow Peak community-app intrusion: The affected population was 21,553 people. Potentially exposed fields were membership numbers, display names, self-introductions and cover images. Addresses, phone numbers, email addresses, passwords and card information were excluded.
9. **Occurred At · 100% confidence · current**  
   Incident and response disclosed: 2026-11-13
10. **Resulted In · 100% confidence · current**  
   Snow Peak community-app intrusion: Further access period begins
11. **Occurred At · 100% confidence · current**  
   Further access period begins: 2026-11-08
12. **Occurred At · 100% confidence · current**  
   Community-data leakage identified: 2026-11-10
13. **Occurred At · 100% confidence · current**  
   First reported community-app access: 2026-10-30

</details>