---
title: "Snow Peak store and member-app account intrusions"
description: "Snow Peak detected suspicious access November 9 and confirmed unauthorized logins to its store/member app on October 29–30 and November 9. It believed the credentials came from outside its systems."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-14"
canonical_url: "https://www.ally.security/incidents/snow-peak-store-member-app-account-intrusions-2026"
markdown_url: "https://www.ally.security/incidents/snow-peak-store-member-app-account-intrusions-2026.md"
stix_url: "https://www.ally.security/incidents/snow-peak-store-member-app-account-intrusions-2026/stix.json"
---

# Snow Peak store and member-app account intrusions

Snow Peak detected suspicious access November 9 and confirmed unauthorized logins to its store/member app on October 29–30 and November 9. It believed the credentials came from outside its systems.

Last modified Nov 14, 2026 · 1 source

## Summary

- **Environment:** Online store and membership application
- **Operational impact:** Temporary service suspension during security response
- **Financial impact:** No confirmed incident cost quantified

## What happened

[Snow Peak](https://www.snowpeak.co.jp/) detected suspicious access November 9 and confirmed unauthorized logins to its store/member app on October 29–30 and November 9. It believed the credentials came from outside its systems. [1](#source-1)

## Impact

Up to 445 accounts were accessed. Identity/contact details, purchase histories, points, payment method and delivery information may have been viewed. Card displays showed only partial numbers; Snow Peak said full card numbers and passwords had not leaked from its systems. [1](#source-1)

## Timeline

### October 29, 2026 — First reported unauthorized logins

First reported unauthorized logins. [1](#source-1)

### November 9, 2026 — Suspicious access detected

Suspicious access detected. [1](#source-1)

### November 13, 2026 — Incident and response disclosed

Incident and response disclosed. [1](#source-1)

### November 14, 2026 — Briefing updated

This briefing was last reviewed and updated on November 14, 2026.

## Threat Group & Attack Vector

Snow Peak believed the credentials used for unauthorized logins had been obtained outside its systems. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): account credentials enabled unauthorized logins. [1](#source-1)

## Response

Snow Peak temporarily suspended the affected services and strengthened security and monitoring. Its [November 13 notice](https://www.snowpeak.co.jp/news/p20261113-0/) planned a store restart that day, with other services awaiting security measures. It had not confirmed secondary harm. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/snow-peak-store-member-app-account-intrusions-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Snow Peak notice of four online-service incidents

official · Snow Peak Inc. · Nov 13, 2026

<https://www.snowpeak.co.jp/news/p20261113-0/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: Snow Peak temporarily stopped the affected services, strengthened security and monitoring, and was reporting to relevant authorities. On November 13 it announced a store restart planned that day; the other services awaited security measures. It had not confirmed secondary harm.
2. **Resulted In · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: Incident and response disclosed
3. **Occurred At · 100% confidence · current**  
   Suspicious access detected: 2026-11-09
4. **Resulted In · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: Snow Peak detected suspicious access November 9 and confirmed unauthorized logins to its store/member app on October 29–30 and November 9. It believed the credentials came from outside its systems.
5. **Resulted In · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: Up to 445 accounts were accessed. Identity/contact details, purchase histories, points, payment method and delivery information may have been viewed. Card displays showed only partial numbers; Snow Peak said full card numbers and passwords had not leaked from its systems.
6. **Occurred At · 100% confidence · current**  
   First reported unauthorized logins: 2026-10-29
7. **Resulted In · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: Suspicious access detected
8. **Resulted In · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: First reported unauthorized logins
9. **Disclosed At · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: 2026-11-13
10. **Affected Organization · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: Snow Peak Inc.
11. **Used Attack Technique · 100% confidence · current**  
   Snow Peak store and member-app account intrusions: https://attack.mitre.org/techniques/T1078/
12. **Occurred At · 100% confidence · current**  
   Incident and response disclosed: 2026-11-13

</details>