BRISBANE, March 14 - Queensland School Photography recently warned a number of schools their online ordering system was "taken down immediately for investigation" because it "may have been compromised".
But scores of parents claimed on social media it was already too late, with one saying they had four unauthorised transactions totalling $2300.
"After paying for our photos a month ago was surprised to wake up and find our family bank account emptied and sent negative with card details stolen through your payment portal," another said on Facebook.
One woman said her card was apparently used to fund Uber rides in Sydney.
The unauthorised amounts appeared to range from hundreds of dollars, up to multiple thousands across numerous transactions, including overseas charges.
Queensland School Photography has assured parents their children's images are safe.
"At no stage has any children's images been at risk. As you are aware our photos are ordered on a prepaid system prior to date of photography," it said in a statement.
"Therefore our photos are not on our website for viewing."
The company said its bank was conducting a full investigation and that the culprits had hacked the site "for the sole purpose of credit card fraudulent activity".
Other schools potentially affected include Holland Park State School, Glasshouse Christian College, Hilliard State School in Alexandra Hills, Elimbah State School and Eatons Hill State School.
It's understood Queensland Police referred inquiries about the matter to the Australian Cybercrime Online Reporting Network.