Total Tools data breach exposed about 38,000 customer accounts

Total Tools, an Australian trade tool retailer with more than 120 stores and wholly owned by the wholesaler Metcash, which bought the remaining 15 percent in late 2023 for $101.5 million, had written to affected customers by 19 September 2024 to say their account information may have been taken after suspicious activity was found on its website.

An initial review by an external cyber forensics team put the number of affected customers at about 38,000. The retailer said the exposed fields could include first and last names, the email address registered to the account, the account password, mobile number, shopping address and credit card details. The company said its investigation into the nature and scale of the incident was still under way.

Chief executive Richard Murray said the business took immediate steps to secure the website once the potential impact was identified, and that it was confident the cause of the incident had been removed. Total Tools said it had brought in cyber security specialists and implemented additional controls to reduce the likelihood of a repeat.

The retailer notified the Australian Cyber Security Centre and the Office of the Australian Information Commissioner. No criminal group claimed responsibility for the incident, and Total Tools did not describe it as a ransomware attack.