Dymocks attack: 1.2 million customer records hit dark web

A security breach at one of Australia’s largest bookstores has seen the personal data of 1.24 million customers published on the dark web.

Dymocks has confirmed 1.24 million customer records have been stolen and published on the dark web. Picture: Britta Campion / The Australian

About 1.24 million customers of one of Australia’s largest bookstores have had their personal information stolen and published on the dark web.

Late on Friday Dymocks confirmed to customers exposed in the breach that their personal information including their home addresses and contact number had been exposed on the dark web.

“While our investigation is ongoing, it has now been confirmed that 1.24 million customer contact records were stolen and made available on the dark web,” the email read.

“The information in the contact records is limited to contact information such as name, address, phone, email, membership details and date of birth.”

The email, written by managing director Mark Newman, notified customers that their information had been made available on the dark web and “ has been accessed and downloaded a number of times”.

The update arrives after Dymocks last Friday revealed it had been the target of a cybersecurity breach. The book retailer said it had become aware of the attack on Wednesday last week but only notified customers on the Friday over email with a note signed by Mr Newman.

“We have become aware that some of our customer information may have been compromised. We are still investigating this but we wanted to be proactive and warn you that there is a chance that this has occurred,” it read.

On Friday, Mr Newman said over email that it appeared the breach took place via a third-party system it had used.

“While our investigation is ongoing, the compromise appears to have occurred in the systems of an external data partner. All our efforts are now focused on understanding if and how this occurred despite the security measures of that partner,” he wrote.

Dymocks was also aware of a scam targeting its customers which had surfaced since the breach took place.

“As an Australian owned, family company that has a successful legacy of serving Australian customers for 144 years I cannot begin to express how devastated the team and I feel about this incident,” Mr Newman wrote in the email.

“We apologise unreservedly that the compromise has occurred, and we’re committed to looking for ways to further strengthen the measures that we and our partners take to keep your information safe.”

Originally published as Dymocks attack: 1.2 million customer records hit dark web