On July 25, 2025, Hello Cake, a sexual wellness company, suffered a data breach due to a misconfigured cloud storage file during a platform migration. An unauthorized third party (threat actor '888') accessed and copied a file containing sensitive customer PII and PHI, including full names, dates of birth, email addresses, phone numbers, prescription details (medication names, identifiers, expiration dates), shipping addresses, order/transaction IDs, and financial discount information. The breach was isolated to a single file tied to telehealth prescription services (partnered with M&D Integrations Inc.) and did not affect other systems.The stolen data was posted on the open web on July 21, 2025, exposing customers to risks of identity theft, fraud, and PHI misuse, though no direct financial data (e.g., credit cards) was compromised. Hello Cake secured the file, conducted an internal investigation, engaged cybersecurity experts, and reported the incident to the California Attorney General on September 19, 2025. Affected individuals were advised to monitor credit reports, place fraud alerts, and use a dedicated support line for assistance. While financial fraud risk is low, the exposure of prescription-related PHI and PII poses significant privacy and reputational consequences.