Shaker & Spoon Data Breach
The 2022 Shaker & Spoon data breach occurred in March 2022 when customer billing and shipment fulfillment databases from Shaker & Spoon (shakerandspoon.com), a leading American cocktail subscription box and craft mixology service, were leaked online.
Exposed Data Types
6- Email addresses
- Names
- Phone numbers
- Physical addresses
- Partial credit card data
- Purchases
About This Breach
What information was affected in the Shaker & Spoon incident?
The leaked customer accounting and shipping files (Bilingdata_userlist.csv, Shiped_userlist.csv, Shipment_userlist.csv) expose transaction records across multiple subscriber cycles. The incident compromised records for 130,191 unique customers, exposing:
- Customer Identity: Customer full names (first and last names).
- Contact Data: Canonical email addresses and telephone numbers.
- Physical Addresses: Complete billing and shipping street addresses, unit/apartment numbers, cities, states, and postal codes across the US.
- Partial Payment Card Data: Payment method, card brand (Visa, Mastercard, Amex), Bank Identification Number (BIN), masked last 4 digits, and expiration month/year.
- Transaction Details: Payment approval results, currency (USD), and delivery metadata.
How many accounts were affected?
Rigorous RFC canonical parsing and deduplication confirmed 130,191 unique valid email addresses.
Technical analysis and security risks
The database files reflect raw merchant payment exports and logistics fulfillment records. Pairing physical residence addresses and direct telephone numbers with cardholder verification attributes (BIN, expiration dates, last 4 digits) provides high-risk reconnaissance material for targeted social engineering and card fraud.
Recommended actions for affected users
Customers of Shaker & Spoon should:
- Routinely review card statements for any unauthorized micro-transactions or unrecognized merchant fees.
- Remain vigilant against package delivery phishing scams via SMS or email soliciting payment information.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
