TL;DR: From late 2023 into January 2024, attackers took over about 15,000 Australian online shopping accounts at brands including The Iconic, Dan Murphy’s, Guzman y Gomez and Event Cinemas. No company was hacked in the usual sense: attackers reused usernames and passwords from older breaches and spent saved cards and store credit. This is credential stuffing. In March 2025 the same method hit Australia’s biggest super funds: more than 20,000 accounts were accessed and four AustralianSuper members lost a combined $500,000. The fix is boring and effective: unique passwords plus MFA.
What happened
Information Age (ACS) reported in January 2024:
- Security firm Kasada counted about 15,000 Australian accounts affected since late November, rising daily.
- The Iconic spotted it first when customers reported unexpected card transactions; it promised refunds.
- Dan Murphy’s owner Endeavour said some accounts were accessed using logins from unrelated third-party breaches.
- Guzman y Gomez and Event Cinemas were also reported as affected.
Prime Minister Anthony Albanese called scams a "scourge." Cyber Security Minister Clare O’Neil urged "strong and unique passphrases" and MFA.
How credential stuffing works
- A site you used years ago gets breached. Your email and password leak.
- Attackers load millions of leaked logins into automated tools.
- The tools try each one on other sites.
- Wherever you reused that password, they get in.
- Inside, they use saved cards, store credit or points, and grab personal info.
The company wasn’t "hacked" so much as you were, years ago, somewhere else. Annoying, but also fixable.
Then it hit retirement savings
Over the weekend of 29-30 March 2025, attackers used stolen passwords against several of Australia’s largest super funds, RNZ reported:
| Fund | What happened |
|---|---|
| AustralianSuper | Up to 600 member passwords stolen; four members lost a combined $500,000, according to an unnamed source |
| Rest | About 20,000 accounts, roughly 1% of members, affected by unauthorised activity |
| Australian Retirement Trust | Several hundred accounts locked as a precaution |
| Insignia (MLC) | 100 Expand Wrap accounts accessed; no financial impact reported |
| Hostplus | Targeted; no losses reported |
AustralianSuper said stolen passwords were used to get in. Prime Minister Anthony Albanese described such attacks as a "regular issue." The difference from the shopping wave: instead of designer clothes and alcohol, the prize was a retirement balance. More in our guide to super fund account attacks.
Why your old passwords are still worth money
According to Telstra, batches of stolen usernames and passwords can contain thousands of logins and sell on the dark web for a few dollars. Once inside a shopping account, attackers use saved payment details to buy goods such as designer clothing, high-end alcohol, gift cards and experiences, shipped to themselves. As Telstra puts it, "a breach of your password on one platform can potentially expose you to a breach on many others."
How to protect yourself
- Unique password for every account. A password manager makes it painless.
- Turn on MFA wherever offered, especially email, banking, super and shopping apps with saved cards.
- Remove saved cards from sites you rarely use. Telstra says saving card details on shopping sites is "akin to" the risk of reusing passwords.
- Use long passphrases for anything you have to remember. Telstra’s example, "CookSteakToTempOf48C," would take centuries to brute-force.
- Check breaches: our free exposure checker shows which breaches your email appears in, so you know which passwords to change first.
- Watch for login alerts and act on them.
If your account was taken over
- Reset the password (and anywhere else you used it).
- Remove saved cards; call your bank about any charges.
- Check the account’s email and phone haven’t been changed.
- Report to the retailer and ReportCyber.
More in our explainer on credential stuffing.
Frequently Asked Questions
What happened to Dan Murphy’s and The Iconic accounts?
In a wave of credential stuffing reported in January 2024, attackers used passwords from other breaches to log in and use saved payment details.
How many Australian accounts were affected?
About 15,000 since late November 2023, according to security firm Kasada.
What is credential stuffing?
Using usernames and passwords stolen in one breach to log into other sites where people reused them.
Were Australian super funds hit by credential stuffing?
Yes. In March 2025, stolen passwords were used against AustralianSuper, Rest and other funds. More than 20,000 accounts were affected and four AustralianSuper members lost a combined $500,000.
How do I stop credential stuffing?
Use a unique password for each account and turn on multi-factor authentication.
Sources
- Information Age: Coordinated cyberattack hits thousands of Aussies (Jan 2024)
- RNZ: Hackers strike Australia's largest pension funds (Apr 2025)
- Telstra Exchange: What is credential stuffing