digiDirect Data Breach Exposes 304,337 Customer Records in Australia
What Happened – In September 2024 a breach of the Australian retailer digiDirect was posted to a public hacking forum. The leak contains 304,337 rows of personally identifiable information, including names, email addresses, phone numbers, physical addresses and dates of birth. Roughly half of the email addresses belong to external marketplace domains such as Amazon, eBay and Westfield.
Why It Matters for Trust & Control Assurance
- This incident illustrates the exact scenario a continuous control‑assurance program is built to detect, document and remediate: unauthorized exposure of customer data across multiple channels.
- Demonstrating ongoing oversight of data‑handling controls (e.g., consent capture, data minimisation, third‑party vetting) provides defensible audit evidence and reduces regulatory risk.
- Leveraging a privacy‑focused control suite enables organisations to collect real‑time evidence that their consent and data‑retention policies are being enforced.
Who Is Affected – Retail and e‑commerce businesses that collect consumer PII, especially those that integrate marketplace sales channels.
Recommended Actions
- Map the exposed data elements to your privacy control objectives (consent, data minimisation, retention) and verify evidence of compliance.
- Conduct a rapid third‑party risk review of any marketplace integrations that may have contributed to the exposure.
- Update breach‑response playbooks to include evidence‑collection steps for audit readiness.
Source: Have I Been Pwned – digiDirect breach
Technical Notes
- Attack vector not publicly disclosed; breach appears to have been extracted and shared on a hacking forum.
- No CVE or specific vulnerability was identified.
- Data types exposed: dates of birth, email addresses, names, phone numbers, physical addresses.
Source: Same as above