A data breach impacting 2.2 million consumers has been reported by Woolworths’ MyDeal subsidiary. The hacker was attempting to resell the stolen information on a hacker forum.
Australian retail marketplace MyDeal links internet customers and nearby merchants.
The world’s largest retailer Woolworths stated its systems are on an entirely separate platform and unaffected by the problem despite purchasing 80% of the firm in September.
MyDeal announced last Friday that it had experienced a breach after a threat actor gained access to the company’s Customer Relationship Management (CRM) system using stolen user credentials. This gave the threat actor the ability to see and export customer information.
According to the business, the data breach affected 2.2 million consumers and exposed information including names, email addresses, phone numbers, delivery addresses, and, in some circumstances, birth dates.
The breach only revealed the email addresses of 1.2 million customers.
MyDeal claims that no credit card numbers, government identification numbers, or account passwords were disclosed.
Consumers who did not receive any information are unimpacted, according to MyDeal, which has already started notifying affected customers of data breaches.
A hacker starts selling data from MyDeal.
The MyDeal hacker started offering the stolen information for sale on a hacking site on Sunday for $600.
According to the hacker, the database presently has 1 million records. But as they complete parsing it, the number of exposed clients will rise.
The threat actor published screenshots of what they claim to be the company’s Confluence server and a single-sign-on prompt for the company’s AWS account as evidence of their attack.
Also, read Police in Australia accuses a teenager of extorting Optus victims.
The threat actor exposed the private data of 286 purported MyDeal customers today by releasing samples of the stolen data.
Even though MyDeal claimed that none of the passwords are revealed in the assault. MyDeal advised that you update your passwords out of an abundance of caution.
All MyDeal clients should be on the watch for targeted phishing attacks. As threat actors frequently buy stolen data to employ in their own assaults.
