Australian cosmetics brand Napoleon Perdis has confirmed a data breach affecting almost 340,000 customers. The breach did not happen in the company's own systems. It happened at Retail Express, a third-party provider the company had used to store customer records. In an email to customers, Napoleon Perdis said it learned of the incident in June 2026. The figures agree across sources: the company's notification gives the exact count as "approximately 339,055 customer records," and ABC News rounds this to "almost 340,000." According to the company, an unauthorised party had access to the system for about seven months, from November 2025 to June 2026. The Office of the Australian Information Commissioner (OAIC) has been notified. No threat actor has claimed the attack or been named publicly.
What Happened
The timeline below comes from the company's customer email, as reported by ABC News on 17 October 2026:
- November 2025: An unauthorised party first gains access to customer records held by Retail Express.
- June 2026: Retail Express tells Napoleon Perdis about a cyber attack. Access ends at around the same time.
- August 2026: Retail Express confirms the access window and the number of affected records (339,055).
- October 2026: Napoleon Perdis notifies customers and the breach becomes public.
The company says "the incident has been contained and the system permanently shut down." The affected customers are those from before June 2025, which suggests the compromised Retail Express environment held a legacy customer dataset that had not been migrated off or deleted. Napoleon Perdis says its current online store was not affected.
About four months passed between Napoleon Perdis learning of the incident (June) and customers being told (October). About two months of that came after Retail Express had confirmed the scope (August). The sources do not explain this gap.
What Was Taken
The company says the compromised system held:
- Full names
- Dates of birth
- Email addresses
- Phone numbers
- Postal addresses
- Purchase histories
The company says the system did not hold bank account details, card details, or passwords for napoleonperdis.com accounts.
No payment data was involved, but this combination of data is very useful for fraud. A name, date of birth, phone number and address together are often enough to pass weak identity checks. Purchase histories let scammers write convincing brand-impersonation lures, such as fake order problems, loyalty rewards or "exclusive" offers that mention real products the victim bought. The company itself has warned customers to watch for scam calls and emails pretending to be Napoleon Perdis.
Why It Matters
Third-party risk is again the cause. The breach happened in a supplier's environment, not the brand's own systems. One aggregator (S3, other-tier) lists several Australian consumer breaches in August 2026 that were traced to third-party providers, including Oz Hair & Beauty (~2M records) and Quest Apartment Hotels (1.5M+). None of the sources links those incidents to Retail Express, and this brief does not suggest a connection. The pattern is still clear: Australian retail and hospitality brands are exposed through the platforms they hand customer data to.
Old data is still a risk. Every affected record belongs to a customer from before June 2025. That data was still exposed more than a year later in a system the company has now "permanently shut down." Data that is kept without a clear business need adds to the potential damage of a breach without adding any value.
Long dwell time is the main concern. About seven months of undetected access suggests that neither the vendor nor its client had effective monitoring of who was accessing the data. This fits a broader trend in 2026 reporting: weekly roundups from FireCompass (S8) and analysis of French government breaches by Inforisque (S7) both describe attackers who log in with valid credentials and then look like legitimate users. Nobody has confirmed that this is what happened at Retail Express.
The Attack Technique
Unknown. Neither Napoleon Perdis nor Retail Express has said publicly how the attacker got in, and none of the sources provides technical details, indicators of compromise, or attribution. No ransomware group or extortion actor has claimed the incident in the material reviewed.
What can be said is limited: - The access lasted a long time (about seven months), which points to quiet data access or exfiltration rather than a disruptive attack. - The way the breach was found (the vendor notifying the client) means the client had no independent visibility into the vendor-hosted data.
Treat any claim about how the attacker got in as speculation until Retail Express or the OAIC releases more detail.
What Organizations Should Do
- Keep an inventory of customer data held by vendors and delete what you no longer need. Find out which suppliers hold legacy customer records, and enforce retention limits in contracts. If data from before 2025 has no current use, it should not be sitting in a third-party system.
- Require breach notification deadlines and audit rights in vendor contracts. Here the scope took about two months to confirm after initial notice. Contracts should require quick preliminary notification and set deadlines for confirming scope.
- Ask for access logs and anomaly alerts from SaaS and retail platform providers. Seven months of undetected access shows a gap in monitoring. Request API and export activity logs, and alerts for bulk data access.
- Shut down retired systems completely. When a platform is replaced, migrate or delete its data and revoke access, rather than leaving the old system running with customer data still in it.
- Prepare for brand-impersonation scams after a breach. Publish clear guidance on how your brand contacts customers, use DMARC to protect your sending domains, and watch for lookalike domains used in phishing that relies on purchase history.
- Shorten the time to notify customers. Under the Notifiable Data Breaches scheme, assess quickly and tell affected people as early as possible. Each month of delay gives fraudsters more time to use the data before victims know to be careful.
Sources: Napoleon Perdis data breach affects 340,000 of the cosmetics compan... | BSI explains first attack vector on Berlin authorities heise online | Nine Breaches, One Blind Spot: The Real Story Behind August 2026’s... | A beauty box that actually knows your shade. Finally. – Style Machine | Elliott Yu | Emanuel Perdis | Cyberattaque : les leçons à tirer des piratages qui ont frappé l’Ét... | Weekly Threat Intelligence Report: