Hello Cake Data Breach

According to the organization's regulator notice, the file could be opened only by someone with its exact link and was not searchable or browsable. An unauthorized party accessed and copied it on or about July 25, 2025. Hello Cake identified the access on August 22, removed the file, and corrected the setting.

The notice says the event did not involve Hello Cake systems, applications, or networks and that no access was found to other files or to the service provider's other systems or consultation data. The file may have contained a name and, for some people, a date of birth, prescribed medication name, and prescription identifier. The notice expressly excludes Social Security, driver's license, and financial account information.

A public breach source separately catalogues 22,907 unique emails, with names, phone numbers, physical addresses, dates of birth, and purchases, in a forum dataset attributed to this event. That separate dataset has a different schema from the official file notice; 22,907 is not an official count of affected people, prescriptions, or orders. No person-level dataset has been imported locally.

The incident alone does not establish that anyone was a Hello Cake customer, bought a sexual-health product, had a prescription, or used a particular medication. Prescription, medication, order, and healthcare associations must remain private, and only direct notice recipients should rely on the fields and instructions in their own letters.