The Dymocks Leak: 841,969 Customer Records Exposed. Yours Might Be One.

HEROIC analysts found a large cache of customer records from Dymocks, the Australian book retail chain, circulating on a dark web forum in June 2023. The breach, which Dymocks publicly disclosed in September 2023, contained 841,969 unique email addresses and extensive personal details across roughly 1.2 million records. For a retailer with a loyal customer base, this kind of exposure hits partcularly hard because it is not just email addresses. It is a full picture of who their customers are.

Your Personal Details Are Out There and They Do Not Expire

Attackers holding this dataset can craft highly convincing phishing emails using real customer names, launch targeted SMS scams using leaked phone numbers, and combine birthdates with names and addresses to open fraudulent accounts or commit identity theft. Unlike a password you can change, your date of birth and home address are permanent, and once they are in a breach dataset they are accessable to anyone willing to pay for them.

What Was Exposed in the Dymocks Breach

• Email addresses (841,969 unique)
• First names
• Last names
• Phone numbers
• Dates of birth
• Gender
• Physical addresses

Why This Matters More Than a Password Leak

Dymocks stored no passwords in this database, but that does not make the breach less dangerous. Full name combined with phone number, email, birthday, and physical address is enough for identity fraud, SIM swapping, and account recovery exploits on major platforms. Criminals can use this data to answer security questions, verify identities at financial institutions, and intercept authentication codes sent by SMS.

How Retail Database Breaches Work

Retail platforms accumulate years of customer data across purchase histories, loyalty programs, and account profiles. When these databases are exfiltrated, typically through a compromised vendor, exposed API, or unpatched application vulnerability, the data occured in a single dump that captures everything the retailer collected. The Dymocks breach appears to have origined from their customer management system, with the data surfacing on underground forums months before the company made a public announcement.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches over 400 billion exposed records, including this Dymocks database. Run a free scan at HEROIC right now to find out if your email address, phone number, or personal details appeared in this leak or any other known breach.