Grocery giant Woolworths has scrambled to cancel over $1 million worth of shopping vouchers after a massive leak of customer data, in which it mistakenly emailed the redeemable codes of 8000 gift cards containing the customers' names and email addresses.
Fairfax Media has obtained a copy of the email which contained an excel spreadsheet with the names and email address of thousands of customers and a downloadable link to 7,941 vouchers, worth a total of $1,308,505. It is understood the spreadsheet was emailed to more than 1000 people, all of whom could access the gift card codes and immediately begin shopping.
As a result of the data leak, customers reported they had logged onto the Woolworths site on Saturday only to discover their vouchers had already been spent.
The data breach, which was discovered on Saturday morning, occured after customers purchased the vouchers from the online savings site Groupon, which ran a deal last week offering BIG W eGift cards, valued at $200 and $100, at a 7.5 per cent discount. The cards were redeemable at Woolworths online and in store, Big W stores, and Caltex petrol stations.
Once customers had paid for the vouchers via the Groupon site they were advised they would receive an email from Woolworths' Everyday Gift Cards containing a PDF attachment with the electronic voucher.
But when some customers proceeded to open the attachment they discovered the excel spreadsheet containing the links to over $1 million worth of vouchers.
Luke, a 36-year-old from Perth, WA, said he decided to check the balance on his 10 giftcards, worth $1900, on the Woolworths website after he realised other customers had probably been emailed the same excel spreadsheet with the links to his vouchers.
"One of my gift cards had be used for online shopping already. Another one had been used in store at Woolworths Parramatta," the father-of-two told Fairfax Media.
"Hopefully my email address doesn't end up somewhere where it permanetly gets lots of spam."
Another customer, Jason Wang, said three of his $200 vouchers had been spent at a Woolworths in Ashfield in Sydney's inner west, about 300km from his home in Canberra.
On Saturday evening, affected customers received an email from Woolworths advising them the gift cards had been cancelled.
But this, too, caused at least one customer further distress.
Mr James, who did not want to disclose his first name, said he "was embarrassed in front of a large number of people" after he attempted to buy his weekly groceries using his gift cards in a Woolworths store on Saturday, only to be told by staff he was using stolen cards.
"They took my money from my credit card and told me I was using stolen cards. I could not take the trolley of groceries home as I did not have enough money to pay.
"I tried to call Woolworths but no one picked up the phone.
"I have had a very very horrible day."
When contacted by Fairfax Media, Woolworths refused to provide any detail on how the data breach occured or the number of customers affected. Instead, they issued a two-line statement.
"Woolworths takes the concerns of its customers and data security seriously," the statement read.
"We experienced a technical fault with an e-voucher offered to customers this week. We are working to resolve the issue and are assisting customers."
