Major online retailer The Iconic has issued a groveling apology after dozens of Aussies’ accounts were hacked by scammers, leaving customers furious.
The Sydney-based online clothing empire – which has more than 2.1 million customers – revealed that hackers had compromised customer accounts since November.
Shoppers have lost thousands of dollars out of pocket due to fraudulent orders, with some saying they were still experiencing them this week.
Several people complained that they only found out their money had been stolen when their banks texted them about the unauthorized purchases.
Daily Mail Australia has taken a look at what happened and what the hack means for customers affected by the scam.
Online fashion retailer The Iconic has become the latest Australian business to fall victim to a malicious hack by scammers
What happened
The Iconic said hackers used stolen usernames and passwords that customers used on other websites to break into their systems – a technique called “credential stuffing.”
Those users would have used the same login details on multiple websites, such as their email or social media accounts.
“Where the compromised email address and password combination was the same as that of an Iconic account, unauthorized access may have occurred,” The Iconic said in a statement.
Hackers placed orders without the account holder’s knowledge.
They have changed the account email addresses, which means their purchase order confirmations are not being sent to the real account holder.
The items are then delivered to inconspicuous addresses.
Some customers have complained that they have lost more than $1,000 as a result.
The Iconic has no security steps when customers want to change the emails on their accounts.
The online fashion empire said the hack was not their fault.
“Please note that this is an ongoing investigation and we will continue to provide updates to all affected customers to ensure they are kept informed,” the statement said.
How do you know if you’ve been caught in the iconic hack?
Customers caught in the hack may be alerted to several messages indicating that scammers have compromised their account.
These messages may be order confirmation emails or amounts from purchases at The Iconic online store that have been debited from the bank accounts of customers they do not recognize.
Shoppers may experience difficulty logging into their Iconic account and may find that their login information does not work because this information has been stolen.
The retailer has urged shoppers to look out for these issues as they are signs they may have been scammed.
The major retailer has apologized (pictured to customers affected by the hack after their login details were stolen).
Does this mean hackers have my credit card information?
Credit card information was not stolen by the hackers, as The Iconic uses a third-party system to process payments.
This means that credit card numbers, their expiration dates and CCV numbers are not stored directly on the company’s accounts or in the internal system.
Hackers cannot access this data from a customer’s personal Iconic account.
How the The Iconic will compensate hacked customers – and what customers should do next
The Iconic said they were working quickly to prevent any more scams from happening and that customers would receive a full refund for any unauthorized purchases.
“We are working with affected customers who notify us of unusual activity,” the company said.
“We plan to contact customers directly whose accounts may have been affected as we continue to investigate the incident.”
Customers have also received an email informing them that they need to change their password for their account.
They will receive an email from the email address order@o.theiconic.com.au advising them to change their login details.
The Iconic offers products from more than 1,500 different clothing brands and has more than 2.1 million customers
Customer, Jessica Byrne, said her husband woke up to a text message about fraudulent transactions – and later discovered that hackers had purchased four items through The Iconic using her bank account
Customers react to the hack
Furious customers have criticized The Iconic’s poor communication following the hack.
Angry shoppers took to social media claiming they never received an email informing them of the scam.
‘Please do a better job communicating important critical issues that impact your customers!’ wrote one user on Instagram.
“Almost $3,000 worth of stuff I bought with my credit card. No communication from The Iconic, not even an email sent to “all” customers,” said another.
‘Contact & (sic) customer service is hopeless…’
Another user claimed that an email the company sent on Tuesday made no mention of the hack, but instead provided a “reminder” about “general account security.”
One shocked customer, Jessica Byrne, said her husband woke up to a text message about fraudulent transactions – and later discovered that hackers had purchased four items through The Iconic using her bank account.
She told 7 News that she had not received any emails stating that she had purchased the items and that the hackers had used her credit card information stored on her account to purchase the items online.
The company released a statement Wednesday apologizing to customers and saying they are working to resolve the issue.
“To our valued customers, we know you are frustrated and you have every right to be,” they said. “We are truly sorry that this happened.”
How can I contact The Iconic if I have any questions?
Customers can contact the company by sending an email to customer.service@theiconic.com.au.
The Iconic has also set up a live chat on their web page, and shoppers can also send a direct message via the company’s Facebook and Instagram pages.