MyDeal, a Woolworths Group subsidiary, announced on Friday, 14 October, that it had identified that a compromised user credential was used to gain unauthorised access to its Customer Relationship Management (CRM) system resulting in the exposure of some customer data.
MyDeal stated it was in the process of contacting the approximately 2.2 million affected customers by email. MyDeal customers who are not contacted by MyDeal have not had their details accessed in the breach. Woolworths Group and MyDeal have also commenced engagement with relevant regulatory authorities and government agencies.
The MyDeal customer data which has been accessed includes customer names, email addresses, phone numbers, delivery addresses, and in some instances, the date of birth of customers (who have previously been required to prove their age when purchasing alcohol). For 1.2 million customers involved in the breach only their email addresses were exposed.
MyDeal stated it does not store payment, drivers licence or passport details and no customer account passwords or payment details have been compromised in this breach. The customer data was accessed within the MyDeal CRM system and the Mydeal.com.au website and app have not been impacted.
Woolworths Group completed the acquisition of approximately 80% of the online marketplace MyDeal.com.au on 23 September 2022. The MyDeal.com.au data network and CRM system is operated on a completely separate platform to Woolworths Group. There has been no compromise of any other Woolworths Group platforms or the Woolworths Group customer or Everyday Rewards records.
MyDeal CEO, Sean Senvirtne, said: “We apologise for the considerable concern that this will cause our affected customers. We have acted quickly to identify and mitigate unauthorised access and have increased the monitoring of networks. We will continue to work with relevant authorities as we investigate the incident and we will keep our customers fully informed of any further updates impacting them.”
Woolworths Group Chief Security Officer, Pieter van der Merwe, said: “Woolworths Group’s cyber security and privacy teams are fully engaged and working closely with MyDeal to support the response.
MyDeal customers with questions can contact MyDeal directly here.
