Breaches and incidents
Mr Max Holdings: app and online store servers breached, up to 1,735,154 members’ data leaked
Mr Max said suspicious server access was confirmed on the evening of 3 Oct and member ID, name, email and phone of up to 1,735,154 members leaked.
- Disclosed
- Verification
- Checked against a primary source
What happened
- Mr Max said suspicious server access was confirmed on the evening of 3 Oct and member ID, name, email and phone of up to 1,735,154 members leaked; address, DOB, card data, passwords and purchase history were not leaked.
- Root cause per the company: “a third party illegitimately used the functionality of software” making up the app and online store to infiltrate servers; no specific vulnerability named.
- No attacker named.
- Services were suspended and external access blocked the same day; the PPC was notified and police consulted; affected members are being emailed.