Home Dymocks' Data Breach: What Marketers Need to Ask Themselves Compliance Dymocks' Data Breach - what marketers need to ask themselves. Earlier this month Dymocks became the most recent Australian corporation to experience a large-scale data breach. Notifying their database by email, Dymocks confirmed that 1.24 million customer contact records had been impacted and are available on the dark web. Information includes customers names, dates of birth, email addresses, postal addresses and gender. Dymocks confirmed that financial information was not breached. As can often happen in these circumstances, Dymocks became aware of the breach on the 6th of September when a concerned third party, Troy Hunt creator of the ‘Have I Been Pwned’ service, disclosed the breach after being shared evidence of Dymocks customer data on the dark web. Dymocks promptly responded – In notifying all customers they confirmed that “while investigations are ongoing and at the early stages, Dymocks’ cybersecurity experts have found evidence of discussions regarding customer data on the dark web” Dymocks also launched an internal investigation and began collaborating with the Office of the Australian Information Commissioner (OAIC) and the Australian Cyber Security Centre (ACSC). Whilst the investigation is still ongoing, Dymocks have reported that they believe the breach was due to unauthorised access to one of their third-party partner’s systems, and that to date it does not appear that there was any unauthorised access to their own system. This incident is yet another live reminder that all Australian businesses need to take the steps required to best protect their customer databases and minimise data breaches (or at the very least the impact that a data breach can have on a customer). While unfortunate for Dymocks, this is not an isolated incident – the OAIC has reported that they were notified of 409 breaches in the first half of 2023. Organisations must take preventive measures when it comes to data privacy and protection. Ask yourself these questions: 1. Do you have an avenue for third-party reporting of potential data breaches? The concerned third-party who disclosed the potential breach to Dymocks, said that “attempting to contact businesses about data breaches can be very difficult, there is usually no specific avenue to report a data breach, and using the general ‘contact us’ page can lead to the disclosure not getting immediate attention”. While in this instance a contact from LinkedIn was used to notify Dymocks, this is not an adequate process for a business to rely on. As an organisation it is prudent to implement a specific avenue that is easily available to the public for concerned third parties to report potential data breaches. It is also imperative that this avenue (inbox etc) is carefully monitored by your business so that your data breach response plan can be actioned as soon as possible. 2. Do you have a quick and effective response plan to a potential data breach? Dymocks fast response plan has been commended . As an organisation you should have a plan for how to deal with a potential data breach in a quick and effective way. Including what and who to disclose in a notification. The right assessment needs to take place to ensure you identify who and how your business will contain the breach and investigate it, who needs to be notified of the breach and if and when to contact the OAIC. 3. Are you minimising the data you store? All organisations should focus on data minimisation – which is ‘limiting the collection of personal information’ to what is directly relevant and necessary to accomplish a specified purpose. The data should only be retained for as long as is necessary to fulfil the purpose. a. Are you only collecting data that is necessary? An organisation should only collect personal data that is necessary for its business. While we do not know the specific reasons around why Dymocks collected the data it did, privacy enthusiasts have already started questioning the need for a bookstore to collect customer’s gender and date of birth. The suggestion is that instead, Dymocks could have collected just the birth year, or even age in a 5-year bracket. This alternate approach would have been far less valuable for malicious actors while potentially still serving the purposes that the business had hoped collecting exact birthdates would. When considering your own business’ risk exposure, ask yourself how you can get the same kind of information in a way that minimises harm in the event of a breach. b. Are you only storing relevant data? A business should not hold on to personal information for longer than necessary. Systems should be put in place to delete old profiles and inactive users’ data. It has been reported that a quarter of the customer records impacted were flagged as inactive, - this issue is not uncommon, it was also seen with the Optus data breach. This could potentially cause a business extra grief, especially since the penalties for serious or repeated offences increased in November 2022 to be the “greater of $50 million, 3 times the value of the benefits obtained or attributable to the breach, or 30% of the corporations “adjusted turnover” during the ‘breach turnover period). As an organisation you need to ensure your whole team is serious about data privacy and protection. The fines are big, the damage to your brands reputation can be bigger but most of all is the impact a breach can have on your Consumers Trust in the way you handle their data. This is the greatest impact of all. FIND OUT FIRST, STAY CONNECTED Sign up to receive ADMA newsletters, updates, trends, special offers, events, critical issues and more Job role*Agency Account Manager/ExecutiveAgency Account/Strategy DirectorCDOCEO / Managing DirectorClient Service / Sales ManagerClient Service/Sales DirectorCMO / CCO / Marketing DirectorCreative Director / HeadData Analyst / Scientist / EngineerDesigner/Copywriter/Creative ManagerEarly Career Data Analyst / Scientist / EngineerHead of Analytics / Analytics LeaderHead of Category/Customer Experience/InsightsHead of Marketing/BrandHead of ProductHR/Learning and Development ManagersIT Director/ManagerLegal/RegulatoryMarketing ConsultantMarketing Executive / CoordinatorMarketing Freelancer / ContractorProduct / Brand / Digital / Communication ManagerSenior Data Analyst / Scientist / EngineerSenior Marketing/Brand ManagerOther You may unsubscribe at any time using the link provided in the communication. View our Privacy Policy. Filter Resources Filter Courses Capability Capability Campaign Integration Compliance Customer Experience Marketing Technology Insights Learnings Brand Development Content Format Content Format Member-only Press-release Article Blog Case Study Data Event Infographic Media Coverage Research Tool-kit Video Webinar Whitepaper Topics Topics CMO Spotlight Global Forum Global Forum 2023 Resource Compliance Resources CEO Blog Compliance Regulatory Content Copywriting Creative Data Data-driven Marketing Digital Campaigns Leadership Social Media Thought Leadership Article 24th Oct 2023 Dymocks' Data Breach: What Marketers Need to Ask Themselves Earlier this month Dymocks became the most recent Australian corporation to experience a large-scale data breach. This incident is yet another live reminder that all Australian businesses need to take the steps required to best protect their customer databases and minimise data breaches. Ask yourself these questions. Article 12th Oct 2023 The Government's Response to the Privacy Act Report Oct 2023 Late September marked a major step forward in the process with the Attorney General releasing its response to the 116 proposal that were outlined in the Privacy Act Review Report. Here is an overview designed to bring Australian marketers up-to-speed. Article 09th Aug 2023 9 mins OAIC Privacy Survey 2023 There has been a sharp increase in the number of Australians who feel data breaches are the biggest privacy risk they face today, according to a major survey released today by the OAIC. The Australian Community Attitudes to Privacy Survey (ACAPS) 2023 provides a comprehensive view of Australians’ privacy attitudes and experiences and how recent events have impacted them. Article 26th Jun 2023 2 min Big month for ACMA Announcements This month, two large Australian companies have been fined by the ACMA for breaches of Australian spam laws. Article 22nd May 2023 8 mins Google Chromes phasing out of third party cookies now has a starting date … and it maybe closer than you are ready for On Friday (Australian time), Google Chrome announced it’s plans to deprecate third-party cookies for one percent of Chrome users in QI of 2024. All data-driven marketers should use this new announcement from Google as the opportunity to either start your teams preparing for the new world and if you are already some ways along – this helps you cement your own timelines. Article 22nd May 2023 8 mins ADMA’s Privacy webinar reveals the good, the bad, and the surprising on Privacy Act changes ADMA recently hosted a webinar bringing together important stakeholders in the ongoing Privacy Review to help get marketers up to speed with what is happening in this vital area. If you missed it, don’t worry we have you covered with the key takeouts below Load More
Article 24th Oct 2023 Dymocks' Data Breach: What Marketers Need to Ask Themselves Earlier this month Dymocks became the most recent Australian corporation to experience a large-scale data breach. This incident is yet another live reminder that all Australian businesses need to take the steps required to best protect their customer databases and minimise data breaches. Ask yourself these questions.
Article 12th Oct 2023 The Government's Response to the Privacy Act Report Oct 2023 Late September marked a major step forward in the process with the Attorney General releasing its response to the 116 proposal that were outlined in the Privacy Act Review Report. Here is an overview designed to bring Australian marketers up-to-speed.
Article 09th Aug 2023 9 mins OAIC Privacy Survey 2023 There has been a sharp increase in the number of Australians who feel data breaches are the biggest privacy risk they face today, according to a major survey released today by the OAIC. The Australian Community Attitudes to Privacy Survey (ACAPS) 2023 provides a comprehensive view of Australians’ privacy attitudes and experiences and how recent events have impacted them.
Article 26th Jun 2023 2 min Big month for ACMA Announcements This month, two large Australian companies have been fined by the ACMA for breaches of Australian spam laws.
Article 22nd May 2023 8 mins Google Chromes phasing out of third party cookies now has a starting date … and it maybe closer than you are ready for On Friday (Australian time), Google Chrome announced it’s plans to deprecate third-party cookies for one percent of Chrome users in QI of 2024. All data-driven marketers should use this new announcement from Google as the opportunity to either start your teams preparing for the new world and if you are already some ways along – this helps you cement your own timelines.
Article 22nd May 2023 8 mins ADMA’s Privacy webinar reveals the good, the bad, and the surprising on Privacy Act changes ADMA recently hosted a webinar bringing together important stakeholders in the ongoing Privacy Review to help get marketers up to speed with what is happening in this vital area. If you missed it, don’t worry we have you covered with the key takeouts below