22nd July 2025 Cyber Update: Australian Fashion Giant and Tech Leader Hit by Data Breaches

Update: Cybersecurity researcher Jeremiah Fowler discovered an unprotected and unencrypted database containing over 3.5 million customer records belonging to Australian fashion brand Sabo. The database, which lacked password protection, contained sensitive customer information including names, physical addresses, email addresses, phone numbers, invoices, shipping information, and return details spanning from 2015 to 2025.

The records appeared to belong to an internal management storage system used to track sales, returns, and domestic and international correspondence. Upon receiving a disclosure notice from Fowler, Sabo restricted the database from public access, though the duration of the exposure remains unknown.

Why it Matters: This breach exposes Australian consumers to significant privacy and security risks, including targeted phishing campaigns and social engineering attacks using legitimate purchase data. Criminals could exploit the detailed invoice information to create convincing fake communications that reference real order numbers, items purchased, and purchase totals to scam customers.

The incident also highlights emerging threats like brushing scams, where criminals use leaked personal information to send unsolicited packages and post fake positive reviews under victims' identities. For the Australian fashion industry, this breach underscores the critical need for proper database security measures and demonstrates how even established brands can inadvertently expose customer data through inadequate cybersecurity practices.

Update: Dell Technologies has confirmed that the World Leaks extortion group successfully breached its Customer Solution Centers platform in July 2025, with the threat actors now attempting to extort ransom payments from the company. World Leaks, a rebrand of the Hunters International ransomware operation that shifted focus from file encryption to pure data extortion in January 2025, claims to have stolen 1.3 TB of data containing over 416,000 files.

The compromised platform is intentionally separated from customer and partner systems as well as Dell's internal networks, containing primarily synthetic demonstration data, publicly available datasets, Dell scripts, systems data, and testing outputs. The only legitimate data stolen appears to be an outdated contact list, with most exposed information consisting of configuration scripts, backups, and system data associated with IT deployments.

Why it Matters: While the immediate impact appears limited due to the synthetic nature of most compromised data, this incident signals a broader shift in cybercriminal tactics from traditional ransomware to data extortion models that are harder to detect and defend against. World Leaks has claimed over 280 attacks since its January 2025 rebrand and published data from 49 organizations, demonstrating the growing threat of extortion-focused cybercrime groups.

For enterprise security teams, this breach highlights the importance of network segmentation and the need to treat even demonstration environments as potential attack vectors. The incident also underscores how threat actors are increasingly targeting technology companies' infrastructure to establish credibility and demonstrate their capabilities to potential future victims.