Planet Ice breach exposed data on more than 240,000 UK skating customers

Planet Ice, which operates 14 ice rinks across the United Kingdom, told customers in late January 2023 that attackers had reached its Ice Account booking system. The company said the intruders gained external access to the non-financial areas of the system.

Have I Been Pwned recorded 240,488 affected accounts when it added the breach on January 31, 2023. The exposed fields included names, dates of birth, genders, email and physical addresses, phone numbers, IP addresses, purchase histories and passwords stored as MD5 hashes, a weak algorithm that modern tools can crack quickly. Records covering children who had held parties at the rinks, including their names, genders and dates of birth, were part of the data.

Many customers first noticed a problem when the booking site returned terse unplanned server downtime messages. Some later said they learned of the breach from Have I Been Pwned or from press coverage before hearing from Planet Ice directly.

Payment card details were not taken, because card processing is handled by a third-party provider. Planet Ice notified the Information Commissioner's Office and engaged external cybersecurity specialists, and it warned customers to treat any further emails about the breach as suspicious and to direct questions to its data protection officer.