Sarah Luke initially shrugged off a data breach that resulted in her personal details being released onto the dark web.
Key points:
- Hackers traded hundreds of counterfeit goods using Sarah Luke's PayPal account
- Adidas and the National Basketball Association filed charges relating to trademark infringement
- The US courts awarded damages against Ms Luke amounting to $US1.2 million ($1.8 million)
But then she was charged in the United States with offences including trademark infringement, and was told to pay damages of $US1.2 million ($1.8 million).
The first inkling of her impending legal drama came via an email in December, referring to counterfeit Adidas items traded under her name.
"I thought it was a scam, another hoax, and I deleted the first email," she said.
"After subsequent emails, I realised, there's something in this, this is real.
"It was shocking, because this is big.
"The charges were cybersquatting, trademark infringement, IP infringement, things I don't know anything about."
Ms Luke said the nightmare began after her information was compromised in the Medibank data breach.
She said this was the only breach of her information she was aware of.
Medibank released a statement to the ABC saying none of its customers' passwords were compromised in the breach, and it was therefore in no way connected to what unfolded for Ms Luke.
Ms Luke said hackers took control of her PayPal account, in a credential stuffing attack in December.
Credential stuffing is where hackers access an account by using automation to try out username and password pairs sourced from data leaks on various websites.
Ms Luke said over the course of two days from December 6 to 8, her PayPal account was used to make hundreds of fraudulent transactions.
She was then served electronically with papers from the US District Court of Florida outlining Adidas' case against her.
Similar charges against her were also filed by the National Basketball Association in the District Court of Illinois.
In both cases, Adidas and the NBA were given leave by the courts to run the cases ex parte — without a requirement for all parties in the case to be present.
In court documents seen by the ABC, default judgements were handed down by the US courts and damages were awarded against Ms Luke of $US200,000 ($293,000) in the NBA case and $US1million ($1.5 million) in the Adidas matter.
Emotional toll
Six months on, the Byron Bay woman said she was no closer to clearing her name.
She has taken the matter to the NSW Police, the Australian Consumer Complaints Authority, the Australian Financial Complaints Commission and the Australian Cyber Security Centre.
"I've come up against so many barriers trying to sort this out," Ms Luke said.
"I have felt unheard and unseen by so many organisations and parties.
"It just goes on and on and I don't know where to go now — I don't know who to turn to."
Ms Luke has engaged an intellectual property lawyer in the United States, with an initial engagement fee of $US10,000 ($14,800), in a bid to have the rulings overturned and the damages retracted.
The single mother of four said the situation was taking its toll.
"The anxiety that this causes, not knowing if they are going to come and take our house, can they freeze my assets, can they get access to my bank accounts?
"We just don't know and it really is a case of guilty until I can prove otherwise."
Legal uncertainty
William Gallagher, a professor of Law at the Golden Gate University in San Francisco and director of the Intellectual Property Law Program, said it was possible the companies behind the lawsuits were just flexing their corporate muscles.
"Maybe just getting the judgement is reward in its own right, it shows they are aggressive enforcers, the message gets out there," he said.
"There are some benefits to famous trademark owners, even if they never end up enforcing the monetary judgement."
He said these types of civil suits were relatively common in the US, as corporate entities worked to protect their brands.
But he said it was not automatic that a US judgement could be enforced in a different jurisdiction, such as Australia.
Ms Luke said it was not a risk she wanted to take.
"I've been unable to get any advice as to whether these lawsuits can stick or whether these companies are just trying to prove a point," she said.
Retired magistrate and dean of law at Southern Cross University, David Heilpern, said if a US company wanted to enforce a judgement in Australia, it would have to register it with the local courts.
Mr Heilpern said even if Adidas and the NBA chose not to pursue the matter here, the judgement could affect Ms Luke's ability to travel to the US.
He said the case highlighted a problem for lawmakers dealing with the rise of cybercrime.
"It's really a sign of the times and technology being in advance of the law," he said.
"This situation would not have occurred 30 years ago before we had digital identities that so easily and seamlessly cross national boundaries.
"The Australian government and the legal mechanisms need to catch up to ensure that … Australians are protected."
The Australian Financial Complaints Authority said it was unable to comment on individual cases it was investigating.
The ABC has also sought comment from the federal Minister for Cyber Security and Home Affairs, Clare O'Neil.
Her office says it will assist Ms Luke to refer the matter to the Australian Federal Police.
Editor's note 28/7/23: This article has been amended to clarify that while Sarah Luke's Paypal account was hacked in December, it was separate to a credential stuffing incident that affected 35,000 customers in the same month.