digiDirect data breach: 304K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2024-10-25
In September 2024, a data breach sourced from the Australian retailer digiDirect was published to a popular hacking forum. The breach exposed over 300k rows of data including email and physical address, name, phone number and date of birth. Approximately half the email addresses were on domains from external marketplaces including Amazon, eBay and Westfield. Exposed data: dates of birth, email addresses, names, phone numbers, physical addresses. The breach dates from Sep 29, 2024; Have I Been Pwned loaded it on Oct 25, 2024.
What to do
- If you had a digiDirect account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
