Amart Furniture Data Breach (2022): What Was Exposed & What To Do

In May 2022, Australian retailer Amart Furniture reported that a cyber attack had exposed more than 100,000 records from its warranty claims database. The incident, disclosed on 16 May, involved customer information that was subsequently shared online. The breach affected approximately 109,000 records. The exposed data included email addresses, names, phone numbers, physical addresses and passwords stored as bcrypt hashes. The database was hosted on Amazon Web Services. Public information does not specify the precise method used to gain access or the exact date of the intrusion.

What happened

Amart Furniture stated that its warranty claims database on Amazon Web Services was targeted in a cyber attack. The company advised customers of the incident on 16 May 2022. More than 100,000 records were taken and later shared online. The records contained email addresses, names, phone numbers, physical addresses and passwords stored as bcrypt hashes.

How a breach like this happens

Incidents involving cloud-hosted databases often begin with an attacker obtaining access credentials or exploiting a configuration weakness in the hosting environment. Once inside, the attacker can locate and copy specific datasets before removing them from the organisation’s systems. Data obtained in this manner is sometimes posted on public forums or file-sharing sites. The use of a hashing algorithm such as bcrypt indicates that passwords were not stored in plain text, though the presence of the hashes still allows offline attempts to recover the original values if they are weak or reused.

About Amart Furniture

Amart Furniture is an Australian retailer that sells household furniture and related products. Like other retailers, it collects customer information when processing warranty claims, including contact details and identifiers that allow the company to match claims to purchases. A breach of this dataset is consequential because the records combine multiple categories of personal information that can be used for further contact or account access attempts.

What was likely exposed

The facts released by the company list the following data types as present in the exposed records: email addresses, names, phone numbers, physical addresses and passwords stored as bcrypt hashes. No additional categories of information have been confirmed in public statements. Organisations of this type commonly store further details such as purchase histories or payment references, but the exact contents of the dataset beyond the named fields remain unconfirmed.

Why it matters

Individuals whose information appeared in the records now face the possibility of receiving unsolicited messages or targeted phishing attempts that reference their recent interactions with the retailer. Hashed passwords may be subjected to offline cracking attempts, increasing risk for anyone who reused the same password on other services. For the organisation, the incident creates operational costs associated with customer notification, security review and potential regulatory reporting.

If your data was in this breach

Review any accounts that use the same email address or password and change those passwords if reuse is suspected. Enable multi-factor authentication on important accounts. Monitor email and postal addresses for unusual activity. Readers can run a free exposure scan of their email address against known breach data to check whether their information appears in this or other incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.