Dymocks Review: A Good Bookshop With a Bad Year Behind It

Walking into a Dymocks is a pleasant experience. Staff who read, tables of new releases, and the kind of range that online listings cannot really imitate.

Judging the company as a whole is harder, because this Dymocks review has to cover a 2023 incident that put the personal details of hundreds of thousands of customers onto hacking forums.

What Happened in 2023

Eight hundred and thirty six thousand accounts. Names, dates of birth, addresses and membership details, but no card numbers.

The dataset contained about 1.2 million records, from which 836,120 unique accounts were identified, so roughly seven in ten lines in that file represented a distinct customer.

The company said it saw no evidence of penetration of its own computer systems and pointed to a potential breach at a third party partner, which is a common pattern and does not remove the responsibility, since the customer handed their details to Dymocks rather than to a supplier they have never heard of.

No payment details were exposed.

That genuinely matters.

The Part That Should Worry You More

The data had been circulating since at least June. The company found out in September, from outside.

A three month gap between data appearing on forums and a company learning about it is the detail worth sitting with, because during that window customers had no idea their details were out there and no reason to be on guard against anything.

It also means the discovery came from outside.

A researcher noticed the file on a forum and told the company, rather than the company spotting it through its own monitoring, and that order of events says something about how closely the data was being watched in the first place.

Names, dates of birth, addresses and membership details are exactly the raw material for convincing phishing, and unlike a card number, none of it can be cancelled and reissued.

If You Had an Account

1. Change the password, and change it anywhere you reused it
2. Turn on two factor authentication wherever that account's email is used
3. Treat any email mentioning your book purchases with suspicion
4. Never click a link in a message claiming your rewards points are expiring
5. Check your email address on a breach notification service

The reused password point is the one that causes real damage, because an attacker with your email and a password you also used for your bank or your email account does not need Dymocks at all after the first login.

The Everyday Experience

Twenty five reviews is far too small a pool to judge a national chain. Read it as a signal, not a verdict.

The published online reviews are poor, with 76% at one star, describing missed delivery dates, items shown in stock that were not, and support that did not answer. The profile is unclaimed, so nobody from the company is replying.

Twenty five reviews across an Australian bookshop chain serving many thousands of customers a week is almost nothing, and unhappy people are the ones who post, so we would not treat this as a measurement of the business.

What it does match is the familiar shape of a long established retailer whose shops work better than its website, which is exactly where most legacy chains struggle.

Where It Still Wins

The shops remain the reason to use Dymocks.

Staff recommendations, the ability to handle a book before buying it, click and collect that puts a title in your hand the same day, and a chain old enough to have outlasted almost every competitor it started with. None of that shows up in an online review pool.

For gift buying in particular, a physical browse beats a search box.

Ask a bookseller. That is the product.

Who Should Buy

Buy in store, or order online for collection, where you get the range and the staff without depending on a delivery process reviewers complain about.

Think twice about ordering online for a deadline, and if you keep an account, use a unique password you use nowhere else.

Final Verdict

Six out of ten, split between a good bookshop and a poor year. The stores, the range and the staff are the reason the chain has lasted, and no card details were exposed in the incident. What costs it points is the Dymocks data breach itself, with 836,120 accounts in a file circulating from June 2023 and only discovered in September, plus online reviews at 2.7 with nobody from the company replying. Anyone reading a Dymocks review who once had an account should change that password today and treat book themed emails with suspicion.

FAQs

What happened in the Dymocks data breach?

A dataset of about 1.2 million records containing 836,120 unique customer accounts appeared on hacking forums and was discovered in September 2023.

Was payment information exposed?

No. The company said it does not store customer financial information.

What information was exposed?

Names, dates of birth, email addresses, postal addresses, gender and membership details.

What should affected customers do?

Change the password, change it anywhere it was reused, enable two factor authentication and watch for phishing.

Is it safe to shop there now?

The company said its online shop remained safe to use. Buying in store avoids the delivery complaints entirely.

Why is the Trustpilot score low?

It reflects 25 reviews, mostly about delivery and support, on a profile the company has not claimed.