Australian cosmetics brand Napoleon Perdis has told customers that almost 340,000 records were accessed without authorisation after a cyber attack on a supplier that stored older customer files. The company described the incident in an email reported on Saturday by ABC News.

According to that message, the firm learned in June 2026 that Retail Express, a third party used to keep customer records, had been hit. In August, Retail Express confirmed that an unauthorised party had access between November 2025 and June 2026 and that about 339,055 records were affected.

Napoleon Perdis said the breach involved customers from before June 2025. The information accessed included names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories.

The company said the affected system did not hold bank accounts, card details or passwords for napoleonperdis.com accounts. It also said the current online store was not affected.

“The incident has been contained and the system permanently shut down,” the email said. Customers were warned to treat scam calls or messages impersonating the brand with caution and to watch their bank transactions. Napoleon Perdis said the Office of the Australian Information Commissioner had been notified. The sources consulted do not show a public OAIC confirmation that an investigation has been opened.

The brand was launched in Sydney in 1995 by makeup artist and businessman Napoleon Perdis, ABC reported. Saturday’s notice concerns older records, not a breach of the current shop.

In June 2026, Australia’s Cyber Daily reported — before customers were formally notified — that a hacking-forum actor known as “2019” claimed to have taken about 339,100 records. That figure is close to the number the company later gave. At the time it was a claim, not an official tally.

RoAdevăr has not seen the forum data dump. The company, in the email cited by ABC, did not name who gained access or say whether the records were published. Customers can still be targeted by fraud even if payment details were not stored on the old system.

Image: Rowanlovescars, MAC Cosmetics store, Toronto Eaton Centre, 29 July 2022, CC BY-SA 4.0, Wikimedia Commons. Not a Napoleon Perdis shop and not the 2026 breach.

Sources consulted: Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients — ABC News; Exclusive: Napoleon Perdis allegedly breached following threat actor claims — Cyber Daily.