Your ad hereSponsor the Retail briefing — the header banner on every printed and downloaded copy.
breach@govern.co.nz🔒 breach.co.nzThe NZ & Australia breach register · a Govern service
Printed 7 November 2026
breach.co.nz/sector/retail/print/
breach.co.nz/sector/retail/print/
🛍️ Retail: reported data breaches
Every retail breach in the breach.co.nz register, New Zealand and Australia, 2022–2025. Each line is a public record; follow the short link to see the sources.
8records
4.2M+people affected (disclosed, 5 of 8)
0 · 8NZ · AU
2confirmed by regulator / court
0penalties or court action
Largest by people affected
- Woolworths MyDeal — 2,200,000 (approx) · AU · 2022-10
- Vinomofo — 928,760 (approx) · AU · 2022-09-25
- Dymocks — 836,120 (approx) · AU · 2023-06
Suppliers named in these records: Snowflake (1). A supplier appearing here is not a finding against that supplier — see each record.
All 8 records
| Organisation | Breach | People | Data reported | Status | Tier |
|---|---|---|---|---|---|
| 🇦🇺 Sydney Toolsbreach.co.nz/breach/au-2025-sydney-tools | 2025-03 | Not disclosed | Details of 34M+ online orders; Records of 5,000+ current and former employees | Disclosed | B · Reported |
| 🇦🇺 Total Toolsbreach.co.nz/breach/au-2024-total-tools | 2024-09 | 38,000 (approx) | Per the company, the data 'may include' names, account email addresses, account passwords, mobile numbers, delivery addresses and credit-card details | Disclosed | B · Reported |
| 🇦🇺 Ticketmasterbreach.co.nz/breach/au-2024-ticketmaster | 2024-04 | Not disclosed | Names, contact details and, per Ticketmaster's notification, encrypted card numbers and expiry dates | Disclosed | B · Reported |
| 🇦🇺 Early Settlerbreach.co.nz/breach/au-2024-early-settler | 2024 | Not disclosed | Full names, emails, phone numbers, delivery addresses and some dates of birth; the company said no payment-card data was stored or exposed | Disclosed | B · Reported |
| 🇦🇺 Pizza Hut Australiabreach.co.nz/breach/au-2023-pizza-hut-australia | 2023-09 | 193,000 (approx) | Names, delivery addresses and delivery instructions, email addresses and phone numbers; for online accounts, masked | Disclosed | B · Reported |
| 🇦🇺 Dymocksbreach.co.nz/breach/au-2023-dymocks | 2023-06 | 836,120 (approx) | Names, dates of birth, email and postal addresses, phone numbers, gender and membership details; Dymocks said it does not store financial data | Under investigation | A · Confirmed |
| 🇦🇺 Woolworths MyDealbreach.co.nz/breach/au-2022-woolworths-mydeal | 2022-10 | 2,200,000 (approx) | Names, email addresses, phone numbers and delivery addresses; about 1.2 million of the ~2.2 million affected customers had only their email address exposed; Dates of birth | Disclosed | B · Reported |
| 🇦🇺 Vinomofobreach.co.nz/breach/au-2022-vinomofo | 2022-09-25 | 928,760 (approx) | Names, gender, dates of birth, contact information and some financial information | Resolved | A · Confirmed |
Reading this briefing
Tier A — Confirmed: a regulator or court has acted or published. Tier B — Reported: the organisation’s own disclosure or credible media, awaiting official confirmation. “People affected” is what the organisation or regulator disclosed; “Not disclosed” means no official figure exists, and we don’t estimate. Totals add disclosed figures only and may overlap.
breach.co.nz is an index of public record, not an investigator. Every record is drawn from regulator releases, court material or the organisation’s own disclosure, and links to its source online. Figures reflect what those sources reported; matters before the courts are allegations not yet determined. Check the live record for the latest — this print-out is a snapshot. Corrections: breach@govern.co.nz.