What happened
In October 2022 Woolworths disclosed that its MyDeal marketplace had suffered a breach affecting around 2.2 million customers [md-ir]. Woolworths said access was gained via a compromised user credential to MyDeal’s customer relationship management system; about 1.2 million of those affected had only their email address exposed, and dates of birth were exposed only for customers who had age-verified to buy alcohol [md-acs]. The breach came days after the major Optus and Medibank incidents.
Timeline
- 2022-10 — Woolworths disclosed the MyDeal breach; ~2.2M customers affected; the OAIC was notified [md-ir], [md-acs].
Current status
Disclosed; affected customers notified. No regulator action has been found. Figures are as stated by Woolworths [md-ir], [md-acs].
Why it matters
Part of the late-2022 wave of Australian breaches that pushed privacy reform up the agenda.