Creams Cafe Data Breach (2025): What Was Exposed & What To Do

In May 2025, approximately 160,000 customer records associated with Creams Cafe were allegedly obtained and later confirmed as legitimate by multiple affected individuals. The exposed information included email addresses, names, phone numbers and physical addresses. Public detail remains limited on how the data left the organisation, and Creams Cafe did not respond to repeated attempts to discuss the incident.

For customers of the UK dessert chain, the episode matters because contact and location details can be reused for phishing, social engineering or unwanted contact. The scale—around 160,000 records—means a substantial number of people may need to take basic protective steps even though the precise method of access has not been disclosed.

What happened

According to the available record, the incident was reported on 1 May 2025. Roughly 160,000 customer records from Creams Cafe, described in the report as “the UK’s favourite dessert parlour,” were allegedly obtained. The data set contained email addresses, names, phone numbers and physical addresses. Creams Cafe did not respond to repeated requests for comment or confirmation. Multiple subscribers to Have I Been Pwned who recognised their own details verified that the data matched their information, lending weight to the claim that the records were authentic. No further public statements from the company, no technical description of the intrusion, and no timeline of detection or containment have been released.

How a breach like this happens

Incidents that expose customer contact lists typically begin with an attacker gaining unauthorised access to a system that stores or processes personal data. Common pathways include compromised employee credentials, unpatched software vulnerabilities, misconfigured cloud storage, or phishing that leads to remote access. Once inside, the attacker may copy databases or export files containing names, emails, phone numbers and addresses. The data is then often packaged and offered or listed on underground forums. Because no specific method has been attributed in this case, the above description remains general background rather than a reconstruction of the Creams Cafe event. Organisations that hold large volumes of customer records face these risks routinely; the absence of a disclosed root cause simply means the public cannot yet know which pathway was used here.

About Creams Cafe

Creams Cafe operates as a dessert-focused café chain in the United Kingdom, serving ice cream, waffles, milkshakes and related products to walk-in and takeaway customers. Businesses of this type commonly collect personal details when customers create loyalty accounts, place online orders, book tables or join mailing lists. Typical data holdings therefore include names, email addresses, telephone numbers and home or delivery addresses—precisely the categories reported in this incident. A breach at such an organisation is consequential because the data is both personal and relatively stable: people change phone numbers and addresses less frequently than passwords, so the information retains value for fraudsters over time. The brand’s public positioning as a popular family-oriented dessert destination also means the customer base is broad, increasing the number of individuals potentially affected.

What data was at risk

The facts name four categories of information as exposed: email addresses, names, phone numbers and physical addresses. These fields match the kinds of data a café chain would ordinarily retain for marketing, order fulfilment or loyalty programmes. No additional data types—such as payment-card numbers, dates of birth, passwords or purchase histories—have been confirmed in the public record. Because the exact contents of every record have not been independently audited beyond the verification provided by affected Have I Been Pwned users, it remains unconfirmed whether every one of the 160,000 entries contained all four fields or whether some records were incomplete. What is known is limited to the four named categories.

The real-world impact

For individuals, the combination of name, email, phone number and physical address creates a ready-made profile that can be used for targeted phishing emails, SMS scams or even doorstep social engineering. Attackers may impersonate the café or other trusted brands, referencing the leaked address to appear more credible. The risk of identity fraud is lower than in breaches that include financial or government identifiers, yet the inconvenience of unwanted contact and the need to remain vigilant are real. For Creams Cafe itself, the episode carries reputational cost, potential regulatory scrutiny under UK data-protection rules, and the operational burden of any future customer notifications or support requests. Because the company has not publicly addressed the matter, customers currently lack official guidance from the organisation on next steps.

Were you affected?

If you have ever registered with Creams Cafe, placed an online order, or joined a mailing list, your details may be among the approximately 160,000 records. Practical first steps include:

• Monitor email and SMS for unexpected messages that reference your name or address and treat any unsolicited links or requests for further personal data with caution.
• Consider changing passwords on any accounts that reuse the same email address, especially if those accounts lack multi-factor authentication.
• Be alert to unusual phone calls or post that appear to know your details; verify any claimed identity independently before responding.
• Run a free exposure scan of your email address against known breach data sets to see whether your information has already appeared in public compilations.

Public detail on the Creams Cafe incident remains limited to the points above. Continued vigilance and basic hygiene around personal contact information remain the most reliable immediate protections.

AICompiled with AI assistance from public sources and published under our editorial standards.