Incident BriefingsSnow Peak reuse-service intrusion

Snow Peak reuse-service intrusion

Snow Peak confirmed on November 12 that unauthorized access on November 9 may have exposed data from its reuse purchasing service. It attributed access to a service vulnerability.

Last modified

Summary

  • Environment: Reuse purchasing service
  • Operational impact: Temporary service suspension during security response
  • Financial impact: No confirmed incident cost quantified
  • Record status: Developing record. Reviewed November 14, 2026; updated as evidence emerges.

What happened

Snow Peak confirmed on November 12 that unauthorized access on November 9 may have exposed data from its reuse purchasing service. It attributed access to a service vulnerability. [1]

Impact

The preliminary scope was 24,948 people. Potential fields included identity/contact and demographic information, customer/order records, identity-verification status and bank-transfer account details. Passwords, card numbers, bank PINs and online-banking credentials were excluded. [1]

Timeline

  1. Reuse-service intrusion

    Reuse-service intrusion.

    [1]

  2. Potential exposure confirmed

    Potential exposure confirmed.

    [1]

  3. Incident and response disclosed

    Incident and response disclosed.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on November 14, 2026.

Threat Group & Attack Vector

Snow Peak attributed this intrusion to a vulnerability but did not identify a CVE or specific exploit. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific ATT&CK technique is mapped from the available evidence.

Response

Snow Peak temporarily suspended the affected services and strengthened security and monitoring. Its November 13 notice planned a store restart that day, with other services awaiting security measures. It had not confirmed secondary harm. [1]