Napoleon Perdis Customer Data Exposed After Supplier Retail Express Is Hacked

Australian cosmetics company Napoleon Perdis has notified customers of a data breach affecting almost 340,000 people. The company said it was told in June that Retail Express, a third party it used to store customer records, had been hit by a cyber attack. In August 2026, Retail Express confirmed an unauthorised party had access between November 2025 and June 2026, affecting approximately 339,055 customer records.

The information accessed included names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. Napoleon Perdis said the affected system did not hold bank account or card details, or the password for customers' napoleonperdis.com accounts. It said the breach affected customers from before June 2025, and that its current online store was not affected. The company said the incident has been contained and the old system permanently shut down.

Napoleon Perdis warned customers to be wary of scam calls or emails impersonating the company and to monitor their bank transactions. The Office of the Australian Information Commissioner has been notified. The case shows how a supplier's security failure can expose a business's customers, even when the business's own current systems are untouched.