Hello Cake Breach Exposes 22,907 Users' Personal Health‑Related Data
What Happened — In July 2025 the sexual‑health product company Hello Cake suffered a data breach. A public hacking forum posted the extracted records, which contain 22,907 unique email addresses together with names, phone numbers, physical addresses, dates of birth and purchase histories.
Why It Matters for Trust & Control Assurance
- The incident illustrates a gap in continuous monitoring of data‑protection controls that a control‑assurance program is built to detect and document.
- Demonstrable evidence of privacy‑policy enforcement, consent management and DSAR readiness is essential to provide a defensible audit trail after a breach.
- Mapping the exposed data categories to a privacy‑control framework helps prove due‑diligence to regulators and partners.
Who Is Affected – Health‑care and consumer‑health product providers; any organization handling sensitive personal health information.
Recommended Actions – Review and tighten consent‑capture processes, conduct a privacy‑impact assessment, verify DSAR procedures, and collect continuous evidence of control effectiveness for audit readiness. Source: HIBP breach record
Technical Notes – The breach source has not been disclosed; the attack vector is unknown. Exfiltrated data includes PII (names, DOB, addresses) and purchase history, which can be leveraged for identity‑theft or targeted phishing. Source: HIBP breach record