What happened
In September 2023 Dymocks Booksellers disclosed a data breach after customer data appeared on the dark web [bleeping-dymocks]. The exposed data included names, dates of birth, email and postal addresses, phone numbers, gender and membership details; Dymocks said it does not store financial data [bleeping-dymocks]. Dymocks did not publish a count. Have I Been Pwned indexed about 836,000 unique email addresses (from roughly 1.2 million records) in the leaked data — an HIBP count, not a company figure [dymocks-hibp].
Dymocks said the source of the breach was an “external data partner” and that systems controlled by Dymocks were not compromised [dymocks-itnews-partner].
Timeline
- 2023-06 — Unauthorised access believed to have occurred [bleeping-dymocks].
- 2023-09 — Dymocks disclosed the breach [bleeping-dymocks]; it later linked the breach to an external data partner [dymocks-itnews-partner].
- 2023-09-25 — Gordon Legal lodged a representative complaint with the OAIC [dymocks-oaic].
- 2024-05-28 — The Australian Information Commissioner accepted the representative complaint [dymocks-oaic].
Current status
Under consideration by the OAIC. A representative complaint about Dymocks’ handling of personal information was accepted by the Commissioner on 28 May 2024 [dymocks-oaic]. The complaint’s allegations (including of a breach of APP 11) have not been determined, and no determination had been located as of November 2026.
Why it matters
A large consumer-retail breach that Dymocks attributed to a third-party data partner — the customer database, not the storefront, was what was exposed.