ANKA April 2025 Data Breach

The Maine Attorney General record reports 537,877 affected persons, with the incident occurring on 30 April 2025, discovered on 22 November 2025, and consumer notifications issued on 16 January 2026. ANKA’s official “Security Incident” notice says unauthorized access affected an April 2025 snapshot in a system used to store customer information and that its core database was not breached.

The reviewed sealed archive contains exactly 537,877 records in its user member, matching the official affected-person count. Across the related collections, the archive contains 5,153,796 physical JSON or sample objects, 1,179,583 valid email occurrences in source-authored fields explicitly named for email, and 562,699 unique canonical emails. The unique-email count can exceed the official person count because sale and shop records also contain buyer, seller, and shop-user emails; 562,699 is not a count of affected people. No fitting was performed to the archive description’s claim of 563,164 unique emails. Its 9 January 2026 label conflicts with the official incident date and was not used as the breach date.

The official notice says names and contact information, demographic data, account status, basic transaction history, and email addresses may have been involved. It expressly says passwords, payment card data, login or authentication tokens, financial information, and sensitive files were not involved. Third-party claims about tokens or financial data are therefore not repeated here. Only the 562,699 canonical emails verified in explicit email fields are imported; names, phone numbers, addresses, dates of birth, gender, tokens, balances, order details, and all other fields are not imported. An email match alone does not prove account ownership or that any other field belongs to the same person.