Planet Ice

Summary

Planet Ice, a UK-based ice rink operator with multiple locations, experienced a data breach compromising non-financial customer information due to a security incident involving third-party service provider IMP-UK. Approximately 200,000 individuals had personal details—including names, addresses, and account passwords—accessed unlawfully, though financial data remained secure through separate payment processor Worldpay. The company confirmed the breach containment, assured customers of restored data security, and issued an apology for the incident's impact.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Planet Ice, a UK-based ice rink operator with 14 facilities including locations in Bristol, Leeds, and the West Midlands, experienced a data breach compromising customer information. The incident occurred on or around January 1, 2023, with public disclosure occurring via customer notifications and a BBC report on January 24, 2023. Attackers accessed non-financial personal data belonging to approximately 200,000 customers through systems managed by IMP-UK, a third-party event services provider for Planet Ice. The compromised information included customer names, physical addresses, and account passwords used for Planet Ice services. Financial data remained unaffected because payment processing was handled separately by Worldpay systems, which were not breached during this incident.

Planet Ice responded by notifying affected customers via email, clarifying the breach scope and confirming financial data security. The company stated IMP-UK’s systems were the intrusion vector and assured customers that compromised personal data had been secured following remediation efforts. No specific attacker methodologies or intrusion timelines beyond the January 1 timeframe were disclosed. The breach impacted customers across all Planet Ice facilities, including its Bristol location that opened in October 2021. Planet Ice issued a public apology for the inconvenience while emphasizing the containment of the breach and the implementation of enhanced security measures for customer data. The incident exposed customers to potential fraud risks through the stolen identifiers but did not disrupt Planet Ice’s operational services at its rinks.

Sources

Sources available to members: 1 source.