Data breach victim told to pay Adidas, National Basketball Association $US1.2m by US courts
Ms Luke said the nightmare began after her information was compromised in the Medibank data breach.
She said this was the only breach of her information she was aware of.
Medibank released a statement to the ABC saying none of its customers’ passwords were compromised in the breach, and it was therefore in no way connected to what unfolded for Ms Luke.
Ms Luke said hackers took control of her PayPal account, in a credential stuffing attack that affected 35,000 PayPal customers in December.
Credential stuffing is where hackers access an account by using automation to try out username and password pairs sourced from data leaks on various websites.
Ms Luke said over the course of two days from December 6 to 8, her PayPal account was used to make hundreds of fraudulent transactions.
She was then served electronically with papers from the US District Court of Florida outlining Adidas’ case against her.
Similar charges against her were also filed by the National Basketball Association in the District Court of Illinois.
In both cases, Adidas and the NBA were given leave by the courts to run the cases ex parte — without a requirement for all parties in the case to be present.
In court documents seen by the ABC, default judgements were handed down by the US courts and damages were awarded against Ms Luke of $US200,000 ($293,000) in the NBA case and $US1million ($1.5 million) in the Adidas matter.
Add comment