Dymocks data breach: what happened and what to do

What happened

On 6 September 2023 Dymocks, the Australian book retailer, learned that customer records might have been accessed by an unauthorised party, and it emailed customers shortly after. The data dated back to June 2023 and was being shared on the dark web.

Have I Been Pwned counted 1.2 million records with 836,120 unique email addresses. Dymocks put the number of customer contact records at 1.24 million.

The company said its own systems weren't breached. It said the compromise appeared to have happened in the systems of an external data partner. It later explained that the partner runs its Booklovers loyalty program and that attackers got hold of the partner's server access keys while Dymocks was moving to a new provider.

What was exposed

The records contained names, email addresses, dates of birth, genders, phone numbers and physical addresses, plus loyalty membership details. Dymocks said none of the published information included passwords, ID such as driver's licences, or payment and credit card details.

That mix is useful to scammers. A name, address, phone number and date of birth together let someone write a convincing email or text that looks like it comes from a shop, a bank or a delivery firm. Expect that kind of message, and treat any that mention Dymocks or your Booklovers account with suspicion.

What Dymocks did

The company told customers to change their passwords as a precaution and to watch for scams. The Australian Information Commissioner later accepted a representative complaint about how Dymocks handled personal information.