In October 2022, 2.2 million customer records were stolen from Woolworths' MyDeal e-commerce subsidiary using a compromised employee credential. This report examines how post-acquisition security integration failures create breach conditions, and what the retail sector's credential-based breach pattern means for ITGC controls.
Marco Cavani
Cybersecurity Analyst
In October 2022, Woolworths Group disclosed that its MyDeal subsidiary had experienced a data breach affecting approximately 2.2 million customers. The breach was enabled by a compromised employee credential that provided access to a MyDeal customer relationship management (CRM) system.
The exposed data included customer names, email addresses, phone numbers, delivery addresses, and, for a small number of customers, date of birth. No payment card data or account passwords were accessed.
Woolworths had acquired MyDeal, an online marketplace, in October 2021, approximately twelve months before the breach. The breach occurred during the integration period when MyDeal was operating its systems separately from Woolworths Group’s main IT environment, under different security standards and controls.
The MyDeal incident is a representative case study in a well-documented post-acquisition risk pattern: the period between acquisition and security baseline alignment is a window of elevated breach risk, because the acquired entity operates with potentially weaker controls while holding data that is implicitly associated with the acquirer’s brand and reputation.
Date: October 2022
Organisation: MyDeal (subsidiary of Woolworths Group, acquired October 2021)
Customers affected: Approximately 2.2 million
Data exposed: Names, email addresses, phone numbers, delivery addresses, and dates of birth for some customers
Attack vector: Compromised employee credential used to access the MyDeal CRM system
Regulatory notification: Australian Privacy Commissioner notified under the Notifiable Data Breaches scheme
Financial impact: Not publicly quantified; Woolworths committed to covering credit monitoring costs for affected customers
The breach was enabled by a compromised credential. An employee’s login for the MyDeal CRM system had been obtained by an attacker, most likely through phishing or credential stuffing using credentials exposed in a previous data breach on another platform.
The attacker used the compromised credential to authenticate to the CRM system and extract customer records. The access was sufficient to retrieve the customer data without triggering immediate detection.
Key technical characteristics:
Single-factor authentication on a system holding 2.2 million customer records: The compromised credential was sufficient to access the CRM without any second factor verification. A system holding the records of 2.2 million customers accessible via username and password alone represents an inadequate authentication control relative to the risk.
Credential stuffing exposure: If the employee’s credentials for the MyDeal CRM were the same as, or similar to, credentials used on other platforms, the attack may have succeeded through automated credential stuffing rather than targeted phishing. Employees who reuse passwords across work and personal accounts create exposure to this attack vector.
CRM system without row-level access restriction: The access obtained through the compromised credential appears to have provided access to the full customer database, not restricted to a subset relevant to the employee’s role. A CRM that allows any authenticated user to query all 2.2 million customer records has an insufficient access control model for the sensitivity of the data it holds.
Woolworths acquired MyDeal in October 2021. The breach occurred in October 2022, exactly one year after the acquisition. This timing is characteristic of the post-acquisition breach window.
When a listed company acquires a smaller e-commerce or technology business, several security integration challenges arise:
Independent IT systems: The acquired entity typically operates its own IT systems, built to its own specifications, without the security standards of the larger acquirer. Integration of those systems into the acquirer’s security baseline takes time and resources.
Different security maturity: Consumer-facing digital businesses that have grown rapidly often prioritise feature development over security investment. Their authentication standards, access controls, and monitoring capabilities may be significantly below those of the acquirer.
Inherited customer data: From the moment of acquisition, the acquirer’s brand is associated with the acquired entity’s customer data. A breach of the subsidiary’s systems is publicly perceived as a breach of the parent company’s brand, regardless of the technical separation of IT environments.
Integration delay: The resources required to integrate the acquired entity’s systems into the acquirer’s security environment typically take 12 to 36 months. During this period, the acquired entity operates with weaker controls but with the reputational risk now borne by the acquirer.
In Woolworths’ case, the MyDeal system was not yet on Woolworths Group’s MFA-enforced authentication platform at the time of the breach. This is not unusual for an entity that was acquired twelve months earlier. It is, however, the gap that the breach exploited.
Multi-Factor Authentication: The most direct control failure was the absence of MFA on the MyDeal CRM system. A second factor that the employee’s compromised password could not have provided would have prevented the attacker from authenticating even with the correct credential. MFA is the single most effective control against credential-based breaches.
Post-Acquisition Security Baseline Assessment: A security assessment of MyDeal’s systems at the time of acquisition should have identified the authentication standards in use and initiated a remediation timeline. If the acquisition due diligence included a security assessment, the CRM authentication gap should have been a finding with a defined remediation target.
Data Access Scope Control in CRM: A CRM system that allows any authenticated user to access all 2.2 million customer records is over-scoped. Role-based access control that restricts individual users to the records relevant to their function limits the blast radius of a credential compromise.
Credential Hygiene Controls: Controls that prevent or detect password reuse across corporate and personal accounts (enterprise password managers, security awareness training, dark web credential monitoring) reduce the exposure to credential stuffing.
Data Minimisation: Customer delivery addresses, dates of birth, and phone numbers are held in the CRM for operational purposes. Assessing whether all data fields retained for all customers are necessary for current operational use, and removing fields that are not, limits the value of any successful breach.
The MyDeal breach is consistent with the dominant breach pattern in the retail sector across the 2020 to 2023 period: attackers using compromised employee or third-party credentials to access customer data systems, with the breach enabled by inadequate authentication controls.
Across Australian retail sector breaches in this period:
The consistent thread is credential compromise as the entry vector, combined with insufficient authentication controls that allow a compromised credential to provide unimpeded access to customer data.
The retail sector’s combination of high customer data volumes, multiple third-party integrations, and historically variable security investment levels creates a structural vulnerability that credential-based attacks reliably exploit.
Make MFA the first security requirement for every acquisition. Post-acquisition security integration should prioritise authentication controls above all other items. A 30-day target for MFA deployment on all customer-facing systems in an acquired entity is achievable and directly reduces the credential-based breach risk during the integration period.
Include security baseline assessment in acquisition due diligence. A security assessment that identifies the authentication standards, access control model, and monitoring capabilities of the target entity provides the information needed to price remediation into the acquisition cost and set integration timelines.
Apply data access scope controls in CRM systems. Every CRM system should restrict individual user access to the customer records relevant to their role. A customer service representative for one region should not be able to query all records for all regions. This is a configuration requirement, not a platform limitation.
Monitor compromised credential databases. Commercial services that monitor for the appearance of corporate email addresses and password hashes in credential breach databases provide early warning of credential compromise before attackers use it. This is a relatively low-cost control that can detect the attack vector before it is exploited.
Define and publish an M&A security integration timeline. Acquisitive retailers and e-commerce companies should have a defined standard for the security controls that must be in place within 30, 90, and 180 days of an acquisition closing. This provides accountability and a clear target for security integration work.
The ITGC controls most directly implicated in this incident map to the following audit testing areas:
Written by
Marco Cavani
Cybersecurity analyst and IT governance professional. Author of digital reports on threat intelligence, critical infrastructure security, and IT audit frameworks.
In November 2023, a cyberattack forced DP World Australia to take its port operations offline for four days, stranding 30,000 containers at four major Australian ports. The incident demonstrated that a single managed logistics provider's security posture could be leveraged to disrupt 40 percent of Australia's container port capacity.
On 12 May 2017, WannaCry ransomware encrypted devices across 80 NHS organisations in England, forcing the cancellation of at least 19,000 appointments and procedures. This report examines how a nation-state-developed exploit became a criminal weapon and what it exposed about patch management and network segmentation in public health infrastructure.
On 5 February 2021, an attacker remotely accessed the control system of the Oldsmar, Florida water treatment plant and raised the sodium hydroxide concentration to 111 times the safe level. An alert operator noticed the cursor moving and reversed the change. This near-miss exposed the open remote access vulnerabilities common in small water utilities across the US.
Get the latest cybersecurity reports, threat intelligence, and IT governance insights delivered straight to your inbox. No spam. Unsubscribe any time.
No spam. Unsubscribe at any time.
The RACM ITGC SaaS platform helps audit professionals manage IT General Controls assessments, from risk and control mapping to workpaper generation and evidence tracking.
