What happened
In September 2024 the hardware and tools retailer Total Tools disclosed a breach affecting around 38,000 customers, a figure the company said came from an initial investigation by a third-party forensic firm [tt-cd]. In an email to customers, Total Tools said the data “may include” names, account email addresses, account passwords, mobile numbers, delivery addresses and credit-card details [tt-ct]. Total Tools’ CEO said the company had notified the OAIC and the ACSC [tt-cd].
Current status
Disclosed. The ~38,000 figure and the description of the data come from the company’s own statements, and the company has not said that card details were definitely exposed [tt-cd], [tt-ct].
Why it matters
Login credentials and card data together could give attackers both account takeover and payment fraud — a high-harm combination for retail customers.