Planet Ice, a UK-based operator of about fourteen public ice-skating rinks, suffered a data breach disclosed in late January 2023. The incident affected the company's "Ice Account" booking platform and exposed records for approximately 240,000 customers. Planet Ice attributed the unauthorized access to its event-services provider, IMP-UK. Financial information was not affected because payment processing was handled separately by Worldpay.\n\nThe exposed data covered email addresses, physical addresses, phone numbers, gender, dates of birth, and passwords stored as weak MD5 hashes. The dataset also included names, dates of birth, and gender for children who had attended birthday parties at Planet Ice rinks, recorded as part of the booking system. Parents and guardians who booked these events were the primary account holders and the parties most likely to have used the platform's password.\n\nBecause the breach exposed minors' personal details combined with home addresses and parent contact information, the practical risk profile is materially more sensitive than a standard customer-list leak. The combination of a child's full name, date of birth, and home address, paired with a parent's email and phone number, creates a base for targeted contact and impersonation attempts that reference specific children and family activities. Parents whose children's details may have been exposed should rotate any reused passwords, treat any unsolicited contact referencing skating activities or party bookings with caution, and consider monitoring for unusual contact aimed at the child's name.

Membership and youth-program organizations collect participant identity, contact details, payment records, event enrollments, membership status, and parent or guardian information across venue and program operations.

Planet Ice continues to operate its rinks following the 2023 incident and has not been publicly tied to further significant breach events. The company notified the UK Information Commissioner's Office and engaged external cybersecurity advisors during incident response. Customer-facing communications were criticized at the time, with many affected users learning of the breach through press coverage or HaveIBeenPwned rather than from Planet Ice directly. There has been no public ICO enforcement action announced against Planet Ice or its event-services partner IMP-UK in the years since, although affected children's data falls within the heightened protections of UK data-protection law.