We understand that some 1.24 million customer records were stolen and published on the dark web in the Dymocks data breach.
It would appear that the stolen records included customer names, gender information, addresses, email addresses, and dates of birth.
Dymocks says it became aware of the data breach on 6 September 2023.
As a result of our investigation, we have lodged a representative complaint with the Office of the Australian Information Commissioner (OAIC) on 25 September 2023 on behalf of our client and other persons impacted by the data breach.
On 28 May 2024, the OAIC informed us that Gordon Legal’s representative complaint has been accepted as being a valid complaint. This is the first step in the OIAC representative proceeding process.
Timeline
6 September 2023
Dymocks says that, on this date, it became aware of a data breach incident in which customer records were stolen and published on the dark web.
8 September 2023
Dymocks wrote to affected customers to inform them of the data breach identified two days prior and told them to change their passwords. This statement confirms that the stolen information includes dates of birth, postal addresses, email addresses, mobile numbers, gender information, and Dymocks membership details.
15 September 2023
Dymocks updated customers on the status of its investigations and told them that 1.24 million customer records were stolen. Dymocks informed customers that the breach appears to have occurred in the systems of an external data partner and that its investigation was on-going.
25 September 2023
Gordon Legal filed a representative complaint with the OAIC.
28 May 2024
The OAIC informed Gordon Legal that the representative complaint has been accepted.
Dymocks Data Breach
Frequently Asked Questions
What is this investigation about?
This investigation is about the Dymocks data breach where 1.24 million customer records were stolen and published on the dark web.
Has a class action commenced?
No. A class action has not been lodged. However, Gordon Legal filed a representative complaint with the Office of the Australian Information Commissioner (OAIC) on 25 September 2023, which was accepted on 28 May 2024. This is the first step in the OAIC Process.
Am I eligible?
You are eligible to register if:
- you were a Dymocks Booklovers member as at 6 September 2023, or
- you gave your personal information to Dymocks at any time before 6 September 2023.
What information do I need to provide to register?
In order to register, you will need to provide us with:
- Your name
- An email address
- A telephone number