What happened
In September 2022 the online wine retailer Vinomofo suffered a breach exposing customer personal information [vino-ia], [vino-tpn]. In 2025 the Privacy Commissioner determined Vinomofo had breached Australian Privacy Principle 11.1 by failing to protect the data, and said the affected database held the personal information of approximately 928,760 individuals [vino-oaic]. The OAIC said the database included financial information, reported as sales and invoice histories [vino-oaic], [vino-tpn]; Vinomofo has said no passwords, ID documents or card/bank details were involved. Media reported in 2022 that Vinomofo had about 500,000 customers on its books; Vinomofo did not give a figure at the time and described the risk to members as “low” [vino-db], [vino-ia].
Timeline
- 2022-09-25 — Data accessed and exfiltrated, as reported from the determination [vino-tpn].
- 2022-10-17 — Vinomofo notified the OAIC [vino-tpn].
- 2022-10 — Breach reported publicly [vino-db], [vino-ia].
- 2025-10-29 — Privacy Commissioner determination (2025 AICmr 175) published [vino-oaic].
Current status
Resolved by determination. The Commissioner made declarations, including that Vinomofo commission an independent review within six months; no penalty was imposed [vino-oaic], [vino-tpn]. The 928,760 figure is the regulator’s; the ~500,000 figure reported in 2022 was a media estimate of the customer base, not a company statement, and is noted for context only [vino-db], [vino-ia].
Why it matters
A regulator determination naming a specific failure and figure is exactly the kind of official record this register is built on — confirmed fact, not estimate.