Adreno Ocean Outfitters

Summary

Adreno, an Australian dive store claiming to operate the world's largest dive store on the Gold Coast, suffered a data breach affecting more than 500,000 customers. The breach was discovered on 12 August 2024 when the Australian Cyber Security Centre notified the company about a breach affecting their point-of-sale (POS) software. Customer names, addresses, phone numbers, and email addresses were exposed.

What Happened

A hacker using the online name "worry" claimed to have breached Adreno's systems in July 2024 and publicly boasted about the hack on 7 August. The Australian Cyber Security Centre notified Adreno on 12 August that their POS software had been compromised. The attacker exfiltrated customer data from both online and in-store transactions. Online customers had their name, shipping address, and phone number exposed, while in-store customers had their name and either phone or email exposed, in some cases both.

Impact on Individuals

The breach exposed contact and address information for over 500,000 customers. Importantly, no credit card or payment information was compromised. Affected individuals should:

• Be alert for phishing emails or text messages appearing to come from Adreno
• Watch for increased spam and unwanted marketing
• Be cautious of scam calls referencing their Adreno purchases
• Monitor for potential "brushing" scams (unsolicited packages)

Organisational Response

Adreno confirmed the incident and stated they were working with the Australian Signals Directorate and the National Cyber Watch Office. The company engaged with the platform from which the data was exfiltrated to assist with the investigation. Adreno took immediate security measures and began notifying affected customers about the breach. The company operates retail locations and claims its Gold Coast store is the world's largest dive store.