🔒breach.co.nz · the NZ & Australia breach register 🛡️ A Govern service
By sector › Retail

🛍️ Retail — data breaches

8 records in the retail sector across New Zealand and Australia.

🖨 Printable Retail briefing
Retail sector · leaderboard
Own the Retail leaderboard
The top banner across the Retail overview and every Retail record — one advertiser, exclusively.
Own this leaderboard → breach@govern.co.nz
Sydney Tools
🇦🇺 Sydney, NSW · breach 2025-03
● Disclosed
People affected
Not disclosed
Data taken
Details of 34M+ online orders, Records of 5,000+ current and former employees
Regulator
None reported
Trust tier
Reported
Source: Cybernews · View record →
Total Tools
🇦🇺 Australia · breach 2024-09
● Disclosed
People affected
38,000 (approx)
Data taken
Per the company, the data 'may include' names, account email addresses, account passwords, mobile numbers, delivery addresses and credit-card details
Regulator
OAIC and ACSC (notified)
Trust tier
Reported
Source: Cyber Daily · View record →
Sponsored placement
Reach decision-makers, in-feed
Native placement alongside the breaches your buyers are already reading.
Enquire → breach@govern.co.nz
Ticketmaster
🇦🇺 Global (Australians who bought North American event tickets) · breach 2024-04
● Disclosed
People affected
Not disclosed
Data taken
Names, contact details and, per Ticketmaster's notification, encrypted card numbers and expiry dates (scope for Australian customers not confirmed; ID Support NSW said payment information was not believed to be affected)
Regulator
None confirmed in cited sources
Trust tier
Reported
Source: Ticketmaster · View record →
Early Settler
🇦🇺 Australia (NZ customers also affected) · breach 2024
● Disclosed
People affected
Not disclosed
Data taken
Full names, emails, phone numbers, delivery addresses and some dates of birth; the company said no payment-card data was stored or exposed
Regulator
OAIC, ACSC, NZ Privacy Commissioner and CERT NZ (company said it was notifying)
Trust tier
Reported
Source: Cyber Daily · View record →
Pizza Hut Australia
🇦🇺 Australia · breach 2023-09
● Disclosed
People affected
193,000 (approx)
Data taken
Names, delivery addresses and delivery instructions, email addresses and phone numbers; for online accounts, masked (not full) credit-card data and one-way-encrypted passwords
Regulator
OAIC (notified)
Trust tier
Reported
Source: BleepingComputer · View record →
Dymocks
🇦🇺 Sydney, NSW · breach 2023-06
● Under investigation
People affected
836,120 (approx)
Data taken
Names, dates of birth, email and postal addresses, phone numbers, gender and membership details; Dymocks said it does not store financial data
Regulator
OAIC (representative complaint accepted 28 May 2024)
Trust tier
Confirmed
Source: BleepingComputer · View record →
Woolworths MyDeal
🇦🇺 Melbourne, VIC · breach 2022-10
● Disclosed
People affected
2,200,000 (approx)
Data taken
Names, email addresses, phone numbers and delivery addresses; about 1.2 million of the ~2.2 million affected customers had only their email address exposed, Dates of birth
Regulator
OAIC (notified)
Trust tier
Reported
Source: Internet Retailing · View record →
Vinomofo
🇦🇺 Australia · breach 2022-09-25
● Resolved
People affected
928,760 (approx)
Data taken
Names, gender, dates of birth, contact information and some financial information (per the OAIC; reported as sales and invoice histories). Vinomofo says no passwords, ID documents or card/bank details were involved
Regulator
OAIC — Privacy Commissioner determination (breach of APP 11.1)
Trust tier
Confirmed
Source: OAIC · View record →
GGOVERN Tabletop Exercises · Govern house Strengthen your cyber resilience — rehearse the decisions that matter. Book a Discovery Call →