TL;DR: In October 2022, an attacker used a compromised user credential to access the customer system of MyDeal, Woolworths’ majority-owned online marketplace. About 2.2 million customers were affected; 1.2 million had only their email exposed. Others had names, phone numbers and delivery addresses, plus birthdates for people who verified their age to buy alcohol. No passwords, payment data or ID documents. The data is old, but contact details don’t expire.
What happened
Information Age (ACS) reported that an attacker used a compromised user credential to get into MyDeal’s customer relationship management system. MyDeal said it found the breach the same day, notified the OAIC and worked with security experts.
What was exposed
| Data | Who |
|---|---|
| Email address only | ~1.2 million customers |
| Names, emails, phone numbers, delivery addresses | The rest of the ~2.2 million |
| Birthdates | Customers who verified age to buy alcohol |
| Passwords | Not compromised |
| Payment details | Not compromised |
| Passport or licence details | Not compromised |
Fun fact nobody asked for: buying a bottle of wine online is how some customers ended up with their birthday in a breach.
Why a 2022 breach still matters
Phone numbers, addresses and birthdays rarely change. Data from older breaches gets combined with newer ones to build fuller profiles. Your MyDeal phone number plus your Qantas Frequent Flyer number plus your Origin partial bank number starts to look like a very convincing scam call.
What to do now
- Check your exposure with our free exposure checker.
- Be wary of "Woolworths" or "MyDeal" refund and prize messages.
- Use unique passwords, since breaches feed credential stuffing attacks.
- Consider a credit ban if your birthday and address are in multiple breaches (how).
Frequently Asked Questions
How many people were affected by the MyDeal breach?
About 2.2 million customers. About 1.2 million had only their email address exposed.
Were MyDeal passwords or cards leaked?
No. MyDeal said passwords, payment information and ID documents were not compromised.
How did the MyDeal breach happen?
An attacker used a compromised user credential to access MyDeal’s customer relationship management system.
Is MyDeal owned by Woolworths?
Woolworths was MyDeal’s majority owner at the time of the breach.
Sources
- Information Age: Data of 2.2m Australians exposed in MyDeal breach
- Reuters factbox via The Star: Major Australian data breaches