Australian cosmetics company Napoleon Perdis has told customers that about 339,055 customer records were accessed in a cyber attack on Retail Express, an outside supplier it had used to store customer records. The data includes names, dates of birth and contact details, but not bank or card details, the company says. The figure counts records, which may not match the number of individual customers.
What the company told customers
The details come from an email Napoleon Perdis sent to customers, as reported by ABC News on Saturday 17 October. In the email, the company said it was told in June that Retail Express, a third party it had used to store customer records, had been hit by a cyber attack.
“In August 2026, Retail Express confirmed the unauthorised party had access between November 2025 and June 2026, affecting approximately 339,055 customer records,” the email said. “The incident has been contained and the system permanently shut down.”
Napoleon Perdis said the breach affected customers from before June 2025.
What data was involved
According to the email, the information accessed included customer names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories.
The company said what was not involved. “This system did not hold your bank account or card details, or the password for your napoleonperdis.com account,” it said. “Our current online store … was not affected.”
Napoleon Perdis has notified the Office of the Australian Information Commissioner (OAIC), Australia’s privacy regulator, ABC reports.
Who is Retail Express?
Retail Express sells point-of-sale, inventory, e-commerce and fulfilment software to retailers across Australia and New Zealand, according to its website. TSN found no public statement from Retail Express about the incident. Neither the company nor Napoleon Perdis has said whether other retailers using Retail Express were affected, so that remains unknown.
No attacker has been named, and the companies have not said how the unauthorised party got in.
The risk for customers
Even without payment details, the combination of names, dates of birth, addresses, phone numbers and purchase histories is useful to scammers. It can make phishing emails, texts or calls look convincing, for example messages that mention a real past order.
Napoleon Perdis warned customers to be wary of scam calls or emails impersonating the company and advised them to monitor their bank transactions. Standard advice is not to click links or share personal or payment details in response to unexpected messages, and to contact the company through its official website if in doubt.
A breach at one remove
The incident is another example of customer data exposed through a supplier rather than the brand itself. That risk is hard for customers to see, because they rarely know which outside systems hold their details. Napoleon Perdis says it learned of the attack in June, but Retail Express only confirmed the access window and scale in August, and customers are hearing about it in October.
The brand was launched in Sydney in 1995 by make-up artist and businessman Napoleon Perdis, ABC notes.
What we don’t know
- How many unique customers the 339,055 records represent.
- Who was behind the attack and how they got in.
- Whether other Retail Express clients were affected.
- Why customers are being notified months after the breach was confirmed.
What this means
- Napoleon Perdis says about 339,055 customer records held by its former supplier Retail Express were accessed between November 2025 and June 2026.
- Names, dates of birth, contact details and purchase histories were involved, but not bank or card details or website passwords.
- Customers from before June 2025 should watch for scam messages that use their personal details, and keep an eye on their bank transactions.
Sources
- ABC News: Napoleon Perdis data breach affects 340,000 of the cosmetics company’s clients
- Retail Express: company website
Related stories
- Hobbs, Phase Eight and Whistles Owner TFG London Hit by Cyber Incident
- Kirin’s FANCL and ATENEA Say Online Shop Data on About 785,000 People Leaked
- Yamato Transport Says About 5.26 Million Pay-Later Customer Records Were Taken
- Google Says Hackers Hijacked AOMEI’s Update Servers in Five-to-Ten-Minute Bursts
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
