T2 Data Breach (2024)

On April 17, 2024, 95,000 records belonging to customers of the T2 tea retailer appeared in a public hacking forum. The dataset includes names, email addresses, physical addresses, phone numbers, dates of birth, purchase histories, salutations, and passwords stored as scrypt hashes. Anyone who has ever placed an order with T2 or created an account there should assume their personal details are now openly available to anyone who downloads the archive.

Reported Details from the Breach

The primary disclosure on Have I Been Pwned states that the T2 incident occurred in April 2024 and that exactly 95K records were published. The exposed information comprises dates of birth, email addresses, names, scrypt-hashed passwords, phone numbers, physical addresses, purchase records, and salutations. The listing does not specify how the attackers first gained access or whether the data was stolen from a single database or multiple systems. It also does not reveal whether the company paid any ransom or was contacted privately before the files were posted publicly.

Why This Matters for You and Your Family

If you or anyone in your household has shopped at T2, your home address, phone number, date of birth, and email are now easy to obtain. These details allow scammers to craft convincing phishing calls or texts that reference a recent tea purchase or your child’s birthday. The presence of passwords stored as scrypt hashes means determined attackers can attempt to crack them offline; any password you reused across other sites is therefore at immediate risk. Because the breach includes purchase history, criminals can also infer income level, delivery routines, and even family size, information that accelerates both identity theft and targeted fraud.

Doxxing and Identity-Chain Risks

Once names, addresses, and emails are public, attackers rarely stop at the initial dataset. They cross-reference the leaked information with usernames found on gaming platforms, social media, or older breaches, rapidly building a complete profile. A single cracked password can hand over an online shopping account, which in turn yields payment methods and further personal documents. For families this creates a cascading exposure: a child’s gaming handle linked to the same family email or address can be hijacked, leading to doxxing, harassment, or demands for ransom inside the game. The speed at which these chains form leaves most people unaware until fraudulent charges or threatening messages appear.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup of Warden to remove what you can.
• Rotate the password used at T2 anywhere it is reused and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same address or email.
• Let the remediation specialists handle takedown requests across data brokers and exposed profiles on your behalf.

The T2 breach is a reminder that even specialist retailers can become sources of identity compromise long after the initial incident fades from headlines. Acting quickly on the exposed data and establishing ongoing visibility is the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real people, and hands-on remediation by specialists who manage takedowns for the entire household, including children’s gaming accounts that frequently become the next link in a doxxing chain.