On April 17, 2024, 95,000 records belonging to customers of the T2 tea retailer appeared in a public hacking forum. The dataset includes names, email addresses, physical addresses, phone numbers, dates of birth, purchase histories, salutations, and passwords stored as scrypt hashes. Anyone who has ever placed an order with T2 or created an account there should assume their personal details are now openly available to anyone who downloads the archive.
Named in this incident?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 582 companies.
See what is exposed about you — free scan →Not ready yet? Run a free breach check on this email
We’ll check it against 13.1B+ leaked records right now — no account needed. Continuous monitoring & alerts are part of Protection.
Reported Details from the Breach
The primary disclosure on Have I Been Pwned states that the T2 incident occurred in April 2024 and that exactly 95K records were published. The exposed information comprises dates of birth, email addresses, names, scrypt-hashed passwords, phone numbers, physical addresses, purchase records, and salutations. The listing does not specify how the attackers first gained access or whether the data was stolen from a single database or multiple systems. It also does not reveal whether the company paid any ransom or was contacted privately before the files were posted publicly.
Why This Matters for You and Your Family
If you or anyone in your household has shopped at T2, your home address, phone number, date of birth, and email are now easy to obtain. These details allow scammers to craft convincing phishing calls or texts that reference a recent tea purchase or your child’s birthday. The presence of passwords stored as scrypt hashes means determined attackers can attempt to crack them offline; any password you reused across other sites is therefore at immediate risk. Because the breach includes purchase history, criminals can also infer income level, delivery routines, and even family size, information that accelerates both identity theft and targeted fraud.
Doxxing and Identity-Chain Risks
Once names, addresses, and emails are public, attackers rarely stop at the initial dataset. They cross-reference the leaked information with usernames found on gaming platforms, social media, or older breaches, rapidly building a complete profile. A single cracked password can hand over an online shopping account, which in turn yields payment methods and further personal documents. For families this creates a cascading exposure: a child’s gaming handle linked to the same family email or address can be hijacked, leading to doxxing, harassment, or demands for ransom inside the game. The speed at which these chains form leaves most people unaware until fraudulent charges or threatening messages appear.