Sarah Luke initially shrugged off a data breach that resulted in her personal details being released onto the dark web.
Key points:
- Hackers traded hundreds of counterfeit goods using Sarah Luke’s PayPal account
- Adidas and the National Basketball Association filed charges relating to trademark infringement
- The US courts awarded damages against Ms Luke amounting to $US1.2 million ($1.8 million)
But then she was charged in the United States with offences including trademark infringement, and was told to pay damages of $US1.2 million ($1.8 million).
The first inkling of her impending legal drama came via an email in December, referring to counterfeit Adidas items traded under her name.
“I thought it was a scam, another hoax, and I deleted the first email,” she said.
“After subsequent emails, I realised, there’s something in this, this is real.
“It was shocking, because this is big.
“The charges were cybersquatting, trademark infringement, IP infringement, things I don’t know anything about.”
Ms Luke said the nightmare began after her information was compromised in the Medibank data breach.
She said this was the only breach of her information she was aware of.
Medibank released a statement to the ABC saying none of its customers’ passwords were compromised in the breach, and it was therefore in no way connected to what unfolded for Ms Luke.
Ms Luke said hackers took control of her PayPal account, in a credential stuffing attack that affected 35,000 PayPal customers in December.
Credential stuffing is where hackers access an account by using automation to try out username and password pairs sourced from data leaks on various websites.
Ms Luke said over the course of two days from December 6 to 8, her PayPal account was used to make hundreds of fraudulent transactions.
She was then served electronically with papers from the US District Court of Florida outlining Adidas’ case against her.
Similar charges against her were also filed by the National Basketball Association in the District Court of Illinois.
In both cases, Adidas and the NBA were given leave by the courts to run the cases ex parte — without a requirement for all parties in the case to be present.
In court documents seen by the ABC, default judgements were handed down by the US courts and damages were awarded against Ms Luke of $US200,000 ($293,000) in the NBA case and $US1million ($1.5 million) in the Adidas matter.
Emotional toll
Six months on, the
