Napoleon Perdis Hack: 339,055 Customers Hit [2026]

Australian cosmetics brand Napoleon Perdis has confirmed a data breach affecting 339,055 customer records, after third-party retail platform Retail Express identified unauthorised access to systems holding customer data between November 2025 and June 2026. The company began emailing affected customers on October 17, 2026, setting off a fresh round of scrutiny over how retailers vet the vendors that store their customer data.

The breach sits alongside a string of high-profile incidents making headlines in Australian cybersecurity coverage this year, but it stands out because the exposed data did not come from Napoleon Perdis’s own servers. It came from a platform the company relied on for years to manage point-of-sale and loyalty records, a detail that is reshaping how retailers think about who actually holds their customers’ information.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech Australia once in the Google app and our stories appear in your news suggestions.

Add Now

What Happened: Napoleon Perdis Confirms the Retail Express Breach

Napoleon Perdis, the cosmetics brand founded by the late make-up artist of the same name, told customers that an unauthorised party gained access to a system operated by Retail Express, a retail management platform used to run point-of-sale, inventory and loyalty functions. The company said it was alerted to the incident in June 2026, while Retail Express itself acknowledged the unauthorised access in August 2026, a two-month gap that highlights how long it can take a vendor to confirm the scope of an intrusion once a client raises concerns.

According to the company’s customer notification, the unauthorised access occurred over an extended window, from November 2025 through to June 2026. That is roughly seven months during which data sat exposed before Napoleon Perdis even learned of the problem, and a further two months before the vendor confirmed what had actually happened. The timeline places this breach among the longer-running third-party incidents reported in Australia this year, and it raises the obvious question of what monitoring was in place at Retail Express during that period. Industry coverage site Bedim Security flagged the incident within hours of the customer notification going out, noting the breach affected records tied to the older Retail Express platform rather than the brand’s current storefront.

The Numbers: 339,055 Records, Not 340,000

Early headlines rounded the affected total up to 340,000 clients, but the confirmed figure released in Napoleon Perdis’s own communication is more precise: 339,055 customer records. That distinction matters for anyone trying to track the scale of this incident against other breaches reported in 2026, since rounded figures tend to get repeated without the underlying detail.

Detail	Figure or status
Confirmed records affected	339,055 customer records
Unauthorised access window	November 2025 to June 2026
Napoleon Perdis alerted	June 2026
Retail Express acknowledged access	August 2026
Customers affected	Accounts created before June 2025
Regulator notified	Office of the Australian Information Commissioner
Data confirmed accessed	Names, dates of birth, emails, phone numbers, postal addresses, purchase histories
Data not stored in affected system	Bank account details, credit card information, website passwords

Which Customers Are Affected

Napoleon Perdis said the exposure is limited to customers who had an account created before June 2025. Anyone who registered or shopped after that cutoff appears to fall outside the affected dataset, at least based on what the company has disclosed so far. The company did not specify exactly why June 2025 marks the boundary, though it likely corresponds to when data in the older Retail Express system stopped being actively used or was migrated elsewhere.

For customers who have shopped with the brand for years, through various store rebrands, loyalty program changes and online storefront updates, this is the kind of notice that is easy to dismiss until you remember just how long some of that account history stretches back. Names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories were all confirmed as accessed. That is enough personal detail to build a convincing phishing email or a fake customer service call, even without any financial data attached.

What Was Not Exposed

Napoleon Perdis was direct about the limits of the exposure in its customer email. The company said the system did not store bank account or credit card information, and it did not retain passwords for napoleonperdis.com. It also said its current online store was not compromised, drawing a clear line between the legacy Retail Express system and the storefront customers use today.

That separation is the detail doing the most work to limit the practical damage here. A breach that exposes contact details and shopping history is a privacy and phishing problem. A breach that exposes card numbers or live account passwords is a direct financial threat. Napoleon Perdis is telling customers this incident falls into the first category, not the second, though customers have no independent way to verify that claim beyond the company’s own statement and whatever the Office of the Australian Information Commissioner uncovers during its review.

Napoleon Perdis’s Statement to Customers

In its notification, Napoleon Perdis told customers that “this system did not store your bank account or credit card information, nor did it retain password for napoleondis.com,” adding that “our current online store… was not compromised.” Those two lines form the core of the company’s reassurance strategy, and reporting from ABC News on October 17 confirmed both statements appeared in the customer-facing email Napoleon Perdis sent out.

Beyond that, Napoleon Perdis has not released a detailed public statement outside the customer notification itself, and it has not said how many of the 339,055 affected accounts belong to customers in Australia specifically versus overseas buyers who may have ordered through the brand’s online store in past years. That level of geographic breakdown, if it exists, has not been made public.

Retail Express and the Third-Party Vendor Risk Problem

Retail Express is a point-of-sale and retail management platform used by a range of Australian retailers to handle transactions, inventory and customer loyalty data in one place. That kind of consolidation is exactly why retail platforms like it have become attractive targets. A single successful intrusion can expose customer records belonging to multiple brands that share the same backend infrastructure, rather than requiring an attacker to breach each retailer individually.

This is the same structural weakness that has shown up repeatedly in Australian breach disclosures over the past few years, a pattern the Australian cyber news desk at CyberStack has been tracking across retail and healthcare incidents alike. Smart-device vendors, cloud storage providers and retail software platforms all sit in the same category: a business trusts a third party with customer data, and the business’s own security posture becomes only as strong as that vendor’s weakest control. The connected-device vulnerabilities uncovered in supermarket refrigeration hardware earlier this year made a similar point from a different angle, showing how a single vendor flaw can ripple out across an entire retail sector.

Why Retail and Loyalty Platforms Keep Getting Targeted

Loyalty and point-of-sale systems are a quieter target than banks or telcos, but they hold a surprisingly rich mix of personal data: names, birthdates, contact details, home addresses and years of purchase history. For an attacker building profiles for identity fraud or running large-scale phishing campaigns, that combination is often more useful than a single stolen password, because it supports convincing impersonation across multiple channels, email, phone and mail.

Retailers also tend to retain this data for far longer than customers expect. Napoleon Perdis’s own disclosure, covering accounts created before June 2025, is evidence of that. Loyalty records do not expire the way a credit card does, and many retail platforms were not built with the kind of data minimisation or automatic purging that security teams now recommend. That design choice, made for marketing convenience years ago, is precisely what turned a years-old account into exposed data in 2026.

The Vendor Disclosure Gap

One detail worth sitting with is the two-month gap between Napoleon Perdis being alerted in June 2026 and Retail Express acknowledging the unauthorised access in August 2026. That gap is not unusual in vendor breach investigations, where forensic review, scoping the affected systems and confirming exactly which records were touched can take weeks. But it does mean the retailer relying on that vendor is often stuck waiting on someone else’s timeline before it can tell its own customers anything concrete. Security tracker The Wire rated the story a high-severity item within its breach feed on the day the notification went out, alongside other data breach and policy items from the same news cycle.

How This Compares to Other 2026 Australian Data Incidents

Napoleon Perdis’s 339,055 affected records is a meaningful breach, but it is modest next to some of the other disclosures Australian organisations have made in 2026. Healthcare group Oracle Health disclosed a breach touching close to 20 million patient records, a scale that dwarfs most retail incidents and highlights how much variation exists in breach size depending on the sector and the volume of data a given system was built to hold.

Incident	Sector	System or vendor involved	Disclosure status
Napoleon Perdis	Retail and cosmetics	Retail Express (third-party retail platform)	Confirmed, OAIC notified, October 2026
Oracle Health	Healthcare	Internal patient records systems	Confirmed, reported affecting close to 20 million records
Danfoss-linked refrigeration flaws	Retail and supermarkets	Connected refrigeration firmware (France)	Patched, flagged after fires reported in affected stores
Federal Court data transfer disclosure	Government and judiciary	Historical offshore data handling arrangement	Disclosed in 2026, more than a decade after the original transfer

The story also made it into broader regional coverage, with Vesper’s report on New Zealand regulators urging stronger security amid AI-enabled cyberattacks citing the Napoleon Perdis breach as part of a wider pattern of customer data exposure across the Tasman. What ties these incidents together is not scale but pattern. In each case, the exposed data sat inside a system one step removed from the organisation customers actually associate with the brand, whether that is a retail software vendor, a connected appliance maker or a historical data-handling arrangement nobody thought to revisit. Napoleon Perdis’s situation fits that pattern closely, and it is likely one reason the story has drawn wide pickup across Australian outlets within a single news cycle.

Historical Context: Australia’s Breach Disclosure Field

Australia’s mandatory data breach notification scheme, overseen by the Office of the Australian Information Commissioner, has been in force since 2018, but it took the large-scale telecommunications and health insurance breaches of 2022 to turn breach disclosure into a mainstream news story rather than a compliance footnote. Those incidents pushed companies and regulators toward faster, more detailed public notifications, and they are part of the reason a mid-sized retail breach like this one now gets same-day national coverage instead of a quiet note buried in a company’s privacy policy page.

Since then, the OAIC has leaned on companies to notify affected individuals quickly and specifically, rather than issuing vague statements. Napoleon Perdis’s approach, naming the vendor, giving a date range for the unauthorised access and listing exactly which data fields were and were not involved, reflects that shift. It is a more detailed disclosure than many companies offered five years ago, even if customers would still prefer more clarity on how the intrusion was first detected.

Market Impact: What This Means for Retail Software Vendors

For Retail Express and platforms like it, incidents of this kind carry reputational weight that extends well beyond the one client in the headlines. Retail management platforms typically serve dozens or hundreds of merchants at once, and a single confirmed breach invites scrutiny from every other business using that same backend, whether or not their own data was touched. Procurement teams at other retailers are likely reviewing their vendor contracts this week purely because Napoleon Perdis’s name is now attached to this story.

That scrutiny tends to show up in two places: contract renewal negotiations, where clients start asking harder questions about data retention and encryption standards, and cybersecurity insurance, where underwriters increasingly treat a vendor’s breach history as a factor in premiums for every client connected to that vendor. Retailers that have not already audited which of their customer data sits with third-party platforms are likely to move that task up the priority list.

What Napoleon Perdis Customers Should Do Now

Anyone who created a Napoleon Perdis account before June 2025 should treat the company’s email as genuine, but verify it carefully rather than clicking links inside it. The safest approach is to go directly to the brand’s official site rather than following any email link, since the exposed contact details make customers a target for follow-up phishing attempts that impersonate the original notification.

Checklist for affected Napoleon Perdis customers:
1. Confirm the notification by visiting napoleonperdis.com directly, not via email links
2. Watch for phishing emails or calls referencing your name, address or past orders
3. Do not reuse your Napoleon Perdis account password anywhere else
4. Turn on multi-factor authentication on email and other retail accounts
5. Monitor for unexpected mail or account sign-up attempts using your details
6. Report suspicious contact to Scamwatch or the OAIC

Because no passwords or payment details were stored in the affected system, there is no indication customers need to change their Napoleon Perdis password or cancel a card as a direct result of this incident. The bigger ongoing risk is social engineering built on the exposed personal details. Readers who want a structured way to reduce exposure to that kind of attack across all their accounts, not just this one, may find it useful to compare multi-factor authentication options and tighten settings on their most-used email account first, since that is the account attackers will target hardest with convincing, detail-rich phishing attempts drawn from a breach like this one.

Password Hygiene After a Breach Notification

Even when a specific password was not exposed, a breach notification is a reasonable prompt to check whether you are reusing that account’s old password anywhere else. Customers who have not reviewed where their saved passwords live in years might use this moment to consolidate into a dedicated manager, a step walked through in TrendinTech’s guide to moving saved passwords out of a browser’s built-in manager, which is a more durable fix than changing one password in isolation.

Competitive Comparison: How Retailers Are Hardening Customer Data

Napoleon Perdis’s experience with Retail Express is prompting comparisons to how other retail-adjacent platforms handle customer data retention and backup practices. The retailers moving fastest on this front share a few traits: they minimise how long customer records are kept, they separate payment data from marketing and loyalty data entirely, and they treat backups of customer databases with the same access controls as the live systems.

Practice	Lower-risk approach	Higher-risk approach
Data retention	Purge or anonymise inactive accounts on a schedule	Retain full account history indefinitely
Payment data separation	Payment details never touch the loyalty or marketing database	Shared systems hold both transaction and loyalty data
Vendor oversight	Regular third-party security audits of platform vendors	One-time vendor onboarding checks with no ongoing review
Backup access control	Backups encrypted with access logging and separate credentials	Backups accessible with the same credentials as production
Breach detection	Continuous monitoring with automated alerts on unusual access	Reliance on manual review or customer-reported anomalies

Businesses that store large volumes of customer records, retail or otherwise, are increasingly expected to treat those backups as seriously as production data. Readers managing their own data backups, whether for a small business or personal records, can see how encrypted, access-controlled storage compares across providers in TrendinTech’s cloud backup service comparison, which covers the same encryption and access-control principles retailers are now being pushed to apply to customer databases.

The Regulatory Response

Napoleon Perdis has notified the Office of the Australian Information Commissioner, as required under Australia’s mandatory data breach notification scheme for incidents involving personal information likely to result in serious harm. The OAIC can request further detail from both Napoleon Perdis and Retail Express about how the breach occurred, how long it went undetected, and what controls were in place during the November 2025 to June 2026 window.

What the OAIC does with that information from here is the part worth watching. The regulator has shown more willingness in recent years to pursue formal investigations and, in some cases, enforcement action following major disclosures, rather than treating notification as the end of the process. Whether this incident draws that level of attention likely depends on what the OAIC’s review finds about how Retail Express secured the data in the first place, and whether other clients of the platform were affected too.

Predictions: What Happens Next

A few things seem likely to follow from here, based on how similar incidents have played out in Australia over the past few years.

Other retailers using Retail Express will likely face questions from their own customers and may issue their own disclosures if additional client data was touched during the same window.
Napoleon Perdis will probably face at least some customer churn or complaint volume in the short term, though cosmetics retail breaches of this size have not historically triggered long-term brand damage in Australia.
Expect renewed attention on vendor due diligence clauses in retail software contracts, particularly around breach notification timelines and data retention limits.
The OAIC’s review is likely to take months rather than weeks, consistent with the pace of its past investigations into comparable third-party incidents.
More Australian retailers are likely to audit which customer data sits with external point-of-sale and loyalty vendors before the end of 2026, given how much attention this story has drawn in a single news cycle.

What the Company’s Statements Tell Us

Napoleon Perdis’s two public lines, that the system held no bank or card details and no website passwords, and that the current online store was not touched, are doing deliberate work to narrow the scope of customer concern. They are specific enough to be checked by a regulator later, which suggests the company is confident in the forensic findings behind them rather than simply offering reassurance without backing.

What the company has not said publicly is just as notable. There has been no detail yet on how the unauthorised access was first discovered, whether it involved a known vulnerability in the Retail Express platform, or whether law enforcement has been brought into the investigation. Those gaps are fairly normal at this early stage of a breach disclosure, and more detail often follows once a formal regulatory review gets underway.

Frequently Asked Questions

How many people were affected by the Napoleon Perdis data breach?
Napoleon Perdis confirmed 339,055 customer records were affected, though early headlines rounded that figure up to approximately 340,000 clients.

What caused the Napoleon Perdis data breach?
The breach involved unauthorised access to a system operated by Retail Express, a third-party retail management platform Napoleon Perdis used to store customer records, including point-of-sale and loyalty data.

When did the unauthorised access happen?
Napoleon Perdis said the unauthorised access occurred between November 2025 and June 2026. The company was alerted in June 2026, and Retail Express acknowledged the access in August 2026.

Was my credit card or bank information exposed?
Napoleon Perdis said the affected system did not store bank account details or credit card information, and it did not retain passwords for napoleonperdis.com.

Which Napoleon Perdis customers are affected?
The company said the exposure involves customers who had an account created before June 2025. Accounts created after that date do not appear to be part of the affected dataset.

Is the current Napoleon Perdis online store safe to use?
Napoleon Perdis said its current online store was not compromised in this incident, distinguishing it from the legacy Retail Express system where the unauthorised access occurred.

Has a regulator been notified?
Yes. Napoleon Perdis has notified the Office of the Australian Information Commissioner, as required for data breaches likely to result in serious harm under Australia’s notification scheme.

What should I do if I received a breach notification email?
Verify the notification by visiting napoleonperdis.com directly rather than clicking links in the email, watch for follow-up phishing attempts referencing your personal details, and avoid reusing any old account passwords elsewhere.

Napoleon Perdis Breach Hits 339,055 Customers [2026]