NewsOnline Security

MyDeal Breach: Users’ Private Information for Sale

Data breaches are occurring regularly all over the world as cybercriminals are targeting big companies everywhere. However, Australia seems to be on the attackers’ radar lately. They breached Optus a few weeks back and now, their latest victim comes in the form of the Australian retail marketplace MyDeal.

Woolworths’ subsidiary connects online shoppers with local retailers where they can buy furniture, homewares, appliances, technology, as well as hardware. In other words, as one of the largest marketplaces, MyDeal has millions of customers.

Apparently, hackers knew that when they breached the company and now, they’re seeing the data of around 2.2 million users online. What happened? Who is affected and what information is for sale? Find out below.

The MyDeal Breach – Quite a Malicious Offer

As we mentioned, the number of data breaches is increasing drastically and it doesn’t seem to be stopping anytime soon. Not long ago, the Indian complaint redressal platform – Swachh City – disclosed a breach that affected over 16 million users.

Before that came the U-Haul breach where hackers managed to get their hands on customers’ names and driver’s license information. Now, over 2.2 million MyDeal customers have been impacted and their personal information is up for sale on a hacking forum.

Yes, the attacker is now selling the harvested information on a hacking forum for $600. According to the hacker, the on-sale data consists of 1 million entries, but more will be added soon.

MyDeal Data

To further prove that the hack is real, the threat actors shared several screenshots of what they claim are MyDeal’s Confluence server and a single-sign-on prompt for the company’s AWS account. The images below reflect their statement:

Single Sign-on Access

The threat actor behind the attack released additional stolen data of 286 alleged MyDeal customers. This shows that the breach is totally legit.

However, despite the huge breach, the company states that no credit card numbers, government identification numbers, or account passwords were exposed.

Have I Been Pwned?

The company shared an official statement disclosing the breach. Surprisingly, one of the recipients was none other than Troy Hunt – Have I Been Pwned?’s creator. Here’s what he had to say via Twitter:

The funny thing is, the cybersecurity expert stated that he doesn’t recall having a MyDeal account. Additionally, the attackers seem to be trolling in MyDeal’s Zendesk customer support system as exhibited in this screenshot:

MyDeal Trolling

Since the large majority of MyDeal’s customers are not affected by this incident, containing the impact of the breach should be an easy task.

The company is taking immediate steps to tighten security across its entire platform and is urging users to reset their passwords.

600 Dollars – Cheap Deal, Expensive Impact

Data breaches will keep occurring as long as cybercriminals are out there. MyDeal is one of several Australian companies to be targeted and we hope it’s the last.

With millions of customers, who knows what cybercriminals can do? The breach didn’t expose payment information, but it did include emails.

In other words, other threat actors will be interested in buying the data for future use – mainly for phishing scams. We highly recommend you stay vigilant when you receive an email from MyDeal.

Jonathan Beesly

Jonathan is the main author at He regularly publishes posts that aim to introduce better cyber-security practices to the masses.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Related Articles

Back to top button