Total Tools Data Leak: 38,000 Customers Impacted
Metcash-owned hardware chain Total Tools is reported to have suffered a major data leak that is believed to have impacted 38,000 customers covering information including their credit card numbers, email addresses and log-in details. The leak is believed to have been perpetrated by professional cyber hackers, according to The Australian. Total Tools has been working on the data leak for a number of days after it first discovered unusual and suspicious activity within its IT systems, and is still investigating the size and scope of the breach.
Impact and Response
After an initial investigation by a specialist third-party forensic cyber specialist, the company is understood to have estimated that customer data linked to 38,000 of its shoppers were illegally compromised. The compromised information includes customer name, email address, password, mobile number, shipping address, and credit card details of customers who recently shopped or registered on the Total Tools website. Total Tools will soon contact its customers alerting them to the data breach. Total Tools chief executive Richard Murray said it had written to affected customers. “The cyber incident has illegally compromised certain personal information, however Total Tools is confident that the cause of this incident has been removed from its website,” he said in a statement provided to The West Australian.
Total Tools: A Growing Hardware Giant
The hardware chain is run by Richard Murray, the former chief executive of JB Hi-Fi. Metcash acquired a majority stake in Total Tools in 2020, and delivered significant sales growth, almost doubling turnover to $1.09 billion in 2023 from $585 million in the 2020 financial year. Towards the end of last year, when the store network expanded to around 112 sites, with plans drawn up to add around 10 stores a year, Metcash took full control of Total Tools by spending $101.5 million to acquire the 15 per cent of the hardware chain it did not already own.
Implications and Lessons Learned
This latest data leak highlights the growing threat of cyberattacks, particularly in the retail sector. Total Tools has over 120 stores across Australia, including 10 in WA. Mr Murray said as soon as the company identified the potential impact of the cyber incident, its team, along with a forensic and cyber security expert, took immediate steps to secure the website and assist with the response. “We continue to work with this expert on this matter. Total Tools’ communications to impacted customers recommended precautions they take to lower the risk of their information being potentially misused,” he said. The retailer has informed the Australian Cyber Security Centre and Office of the Australian Information Commissioner. It follows high-profile cyber attacks on health insurer Medibank and telco giant Optus. One of the biggest data leaks to have hit Australia recently was recorded back in 2022 when publicly-listed health insurer Medibank was the subject of a cyber attack saw the records of more than 10 million customers compromised. It cost Medibank more than $30 million and regulator APRA forced the insurer to set aside a capital adequacy requirement of $250 million after “weaknesses” were identified in its IT infrastructure.
Moving Forward
The incident underscores the importance of robust cybersecurity measures for businesses of all sizes. Businesses need to invest in comprehensive cybersecurity solutions to protect their customers’ data and mitigate the risk of breaches. Metcash has alerted the government’s Australian Cyber Security Centre regarding the latest data leaks. Investigations into the nature and the size of the breach are still ongoing at the time of writing and Total Tools has informed the Australian Cyber Security Centre and the Office of the Australian Information Commissioner.
