Cyber attack on Australian book distributor leaves bookshops empty-handed before Christmas

Key points

• Unauthorised access to Alliance Distribution Services computer systems is believed to have occurred on 18 July 2025.
• ADS, a subsidiary of Hachette Australia, distributes 15 to 20 per cent of stock for some independent bookshops.
• No timeline for full restoration has been confirmed, and no data theft has been publicly reported.
• Independent bookshops face rising costs after being advised to source stock through alternative suppliers.

Six weeks ago, boxes from Hachette Australia stopped arriving at Mary Martin Bookshop in Melbourne. Owner Jaye Chin-Dusting knew something was wrong, but no one could tell her exactly what.

The cause, as first reported by ABC News Australia, was unauthorised access to the computer systems of Alliance Distribution Services (ADS), a company that moves books from Hachette's warehouse to booksellers across the country. Hachette says the incident is believed to have begun on 18 July.

What happened to ADS?

Hachette Australia confirmed that criminals gained access to ADS systems without permission. A ransomware attack, where criminals install malicious software that locks a company's files and demand payment to unlock them, is considered the most likely cause by Matthew Warren, Director of RMIT University's Centre for Cyber Security Research and Innovation. Hachette has not confirmed this publicly.

The attack froze normal distribution operations. ADS staff have been manually processing some orders, prioritising new release titles. But the backlog of older books, called backlist titles in the trade, remains hard to shift.

"ADS would supply us 15 to 20 per cent of the books that we usually have on our shelves," Chin-Dusting said. "If it goes on for much longer, our bookshop will need to start obviously having to look at other options."

Who is feeling the pain?

The timing is damaging. Christmas is the biggest trading season for booksellers, and September school visits are already being cancelled. Children's author Danielle Binks had planned to visit Adelaide, sign copies of her new book, and present to school students. She was told Hachette cannot guarantee which shops have stock or restock them in time.

"My publicists and sales team at Hachette are equally gutted," Binks said.

Melbourne author Maxine Beneba Clarke warned on Instagram that the disruption could cost her a significant portion of her income, possibly for years.

Hachette advised booksellers to source stock through alternative suppliers, including online retailers and overseas distributors. That shifts freight costs onto already squeezed small businesses.

Should bookshops and authors expect more transparency?

Both Binks and Chin-Dusting said Hachette has been slow to share details. "Communication has been a little bit of a challenge," Chin-Dusting said. Binks put it plainly: "Part of me wishes that there had been more transparency."

Hachette's public statement acknowledged the disruption and apologised, but gave no recovery date. Australia's breach notification law, the Notifiable Data Breaches scheme administered by the OAIC (the Office of the Australian Information Commissioner), requires companies to notify that regulator and affected individuals when a breach is likely to cause serious harm. No public notification of a data breach has been filed at the time of writing.

Professor Warren cautioned that as criminals use AI tools, meaning software that can automatically scan thousands of systems for weak points, attacks like this will become more frequent. Businesses of every size need to treat security investment as a core operating cost, not a line item to cut.

For readers who buy from independent bookshops: your local store may have gaps on the shelf right now through no fault of its own. Ordering in advance, asking staff what is available, and being patient with delays are the most practical things you can do.