Dymocks Bookstore Chain reports data breach, customer data exposed on dark web

Dymocks, a well-known Australian bookstore chain is reporting a potential data breach that has the potential to expose customer personal information. The report came through an email informing customers that a breach was discovered on September 6, 2023. An unauthorized party may have gained access to some of the company's customer records.

Upon detecting the breach, Dymocks promptly initiated an investigation in collaboration with cybersecurity experts to determine the exact nature and scope of the incident. While the investigation is still in its early stages, there is evidence suggesting that discussions about customer records being available on the dark web have taken place.

The specific details regarding which customers might be impacted remain unclear at this stage of the investigation. However, the potentially compromised information includes:

• Names
• Email Addresses
• Postal Addresses
• Phone Numbers
• Gender
• Dates of Birth
• Membership Details

The number of exposed individuals and the nature of the attack are not disclosed

Journalists has been able to locate an individual claiming to be selling the data on a popular clear web data leaks forum. The user seems to have 1.2 million records of 836,120 unique Dymocks accounts. The person selling the information has provided some sample sets of the data, and other forum users have confirmed it appears to be legitimate.
“For what it’s worth,” one user has posted, “I can verify by correlating with other Australian breaches that at least two of the sample entries look legit because the data matches known good older beaches (Medicare I think).”
The breached data was offered for sale on 3 September, and the current asking price to unlock it is about €3.75, or just over $6 – anyone with enough site credits can unlock the data to use as they wish. The information is in a single .csv file, suggesting that it is from a single database.

Dymocks emphasized that they do not store or hold any customer financial information, so such data was not included in the breached records, ensuring that sensitive financial details are not at risk.

Update - The book retailer has identified the source of a data breach, as an “external data partner” but hasn't named the third party. In additional details the investigation concluded that an unknown person stole access keys for a web server used by the third-party provider, with the hacker going on to use the keys to access the provider’s servers.

The company suggested customers keep an eye on their online accounts and consider changing passwords to boost security.