Breach · · 3 min read
Napoleon Perdis: 339,055 customer records exposed through a supplier
The Australian cosmetics brand says an old customer system run by Retail Express was accessed from November 2025 to June 2026. Names, birth dates and addresses were taken.
Australian cosmetics brand Napoleon Perdis has told customers that their details were caught up in a cyberattack on Retail Express, an outside company it used to store customer records. About 339,055 records were affected. If you bought from Napoleon Perdis before mid-2025, here’s what you should know.
What happened
According to the company’s email to customers, reported by ABC News, Napoleon Perdis learned in June 2026 that Retail Express had been attacked. In August, Retail Express confirmed that an unauthorized party had access between November 2025 and June 2026, affecting approximately 339,055 customer records. The company says the incident has been contained and the system permanently shut down.
The affected customers are those from before June 2025. The information accessed included:
- names and dates of birth
- email addresses and phone numbers
- postal addresses
- purchase histories
The company says the system didn’t hold bank account or card details, or passwords for napoleonperdis.com accounts, and that its current online store wasn’t affected. The Office of the Australian Information Commissioner has been notified.
What this means for you
There’s nothing here that lets someone into your bank. What it does give a scammer is a believable story: your name, birthday, address and what you bought. Napoleon Perdis has warned customers to expect scam calls and emails pretending to be from the company.
It’s also a reminder that your data often sits with companies you’ve never heard of. You shopped with a cosmetics brand; the records were held, and stolen, at a software supplier.
What you can do
- Be careful with “your order” or “your loyalty reward” messages. Don’t click links in unexpected messages. Go to the brand’s site yourself.
- Keep an eye on your bank statements, as the company suggests, and report anything you don’t recognize.
- Be wary of callers who know your birthday. A date of birth is often used as a security question. If a caller asks you to “confirm” details, hang up and call back on a number you found yourself.
- Read up on scams built from leaked data: how scammers use leaked data.
How Frame helps
Frame keeps a catalog of known breaches. Add the ones you know you were part of to a verified email and Frame shows what each exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame also has step-by-step guides for opting out of data brokers, which cuts down how much of your address and phone number is sitting around to be matched with a leak like this. We never collect or store the leaked records themselves.
Sources
- ABC News, Napoleon Perdis data breach affects 340,000 of the cosmetics company’s clients, October 17, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.