Napoleon Perdis: about 339,000 former customers' records exposed through breach at former retail platform Retail Express — names, birth dates, contact details and purchase history; OAIC notified
Australian cosmetics brand Napoleon Perdis has emailed customers to say a third party it used to store customer records, Retail Express, was hit by a cyber attack. According to the email, reported by the ABC on 17 October 2026, Napoleon Perdis was told in June, and in August 2026 Retail Express confirmed that an unauthorised party had access between November 2025 and June 2026, affecting approximately 339,055 customer records. The affected records belong to customers from before June 2025. Information accessed includes names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. The company says the system did not hold bank account or card details or napoleonperdis.com account passwords, that the incident has been contained and the system permanently shut down, and that its current online store was not affected. The Office of the Australian Information Commissioner has been notified. Napoleon Perdis warns customers to watch for scam calls or emails impersonating the brand and to monitor bank transactions. Context: on 9 June 2026 Cyber Daily reported that the forum actor known as 2019 had listed Napoleon Perdis and claimed 339,100 customer records (including loyalty points, transaction history and spending totals), released free on a hacking forum; the company had not confirmed that claim at the time. Primary: Napoleon Perdis customer email as reported by ABC News (17 Oct 2026).
- Product
- Retail Express (third-party retail and customer-records platform formerly used by Napoleon Perdis)
- Versions
- n/a — incident
- Exploited in Australia?
- unknown
- Patch to
- Customers: expect scam calls, texts and emails that use your name, birth date and purchase history; do not act on payment or 'refund' requests claiming to be Napoleon Perdis, and check bank transactions. Retailers: list every third-party POS, loyalty and customer-record platform that still holds legacy customer data, delete or archive what you no longer need, and make sure supplier contracts require prompt breach notice.
Primary: ABC News — Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients (17 Oct 2026, quoting the customer email) · Cyber Daily — Napoleon Perdis allegedly breached following threat actor claims (9 Jun 2026)