The story in brief
- ABC News reported on 17 October 2026 that approximately 339,055 Napoleon Perdis customer records were affected through Retail Express, a third-party system.
- The retailer's email says the affected customers were from before June 2025. The reported access window was November 2025 to June 2026.
- Names, birth dates, contact details and purchase histories were involved. The retailer said the system did not hold bank details, card details or online-store passwords.
- Check notices through the retailer directly and be cautious about impersonation calls, refund offers and messages asking for codes or payment information.
What happened at Napoleon Perdis?
The Napoleon Perdis data breach concerns customer information stored with Retail Express, a third-party service the cosmetics retailer had used to manage customer records. ABC News's 17 October report quotes an email Napoleon Perdis sent to customers, placing the number of affected records at approximately 339,055.
According to that email, the retailer was informed of the cyber attack in June 2026. In August, Retail Express confirmed that an unauthorised party had access between November 2025 and June 2026. Those dates describe the reported access window, not a new attack beginning on the day the news appeared.
The retailer said the incident had been contained and the affected system permanently shut down. ABC also reported that the Office of the Australian Information Commissioner had been notified. These are attributed company statements, not findings from our own inspection of the system.
Which customers are affected?
Napoleon Perdis said the breach affected its customers from before June 2025. The date matters: an older customer record can still contain a usable email address, phone number or home address even after a retailer stops using a system.
The 339,055 figure is the approximate number of customer records quoted in the retailer's email. It should not be converted into a separately verified count of unique people. ABC's headline rounds the scale to 340,000.
The retailer said its current online store was not affected. That does not mean an existing online shopper could not also have an older record in the affected system. If you need an individual answer, open the retailer's genuine website yourself and use its established support route.
What information was accessed?
ABC reports that the accessed information included customer names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. The report does not establish that every record contained every field.
A purchase history can make a fake customer-service call more convincing. A caller knowing your name or a past purchase is not proof that they work for Napoleon Perdis. This is a practical risk arising from the categories disclosed, not evidence of a confirmed follow-up scam against each customer.
Were payment details or passwords involved?
The retailer's email, quoted by ABC, says the affected system did not hold bank-account or card details, or the password for a napoleonperdis.com account. Keep that statement specific to the affected system rather than treating it as a guarantee about every service or message.
There is no basis in this reporting to say customers must cancel a card solely because their contact record was involved. If you supplied payment information to a suspicious caller or see an unauthorised transaction, contact your bank promptly through its official app or the number on your card.
What should customers do now?
The retailer warned customers about scam calls and emails impersonating it and advised monitoring bank transactions. The Australian Cyber Security Centre's breach guidance also recommends checking what was exposed and responding to the particular information involved.
- Verify the notice independently. Open Napoleon Perdis directly, rather than using a link in an unexpected email or text. Ask its genuine support team about any unclear notice.
- Expect convincing impersonation. Do not give a caller passwords, verification codes, card details or identity documents because they know your address or shopping history.
- Secure reused credentials. The affected system reportedly did not contain store passwords. Separately, replace any password you reuse and enable multi-factor authentication on your email account where available.
- Act on misuse. Review account and bank activity. If you sent money or shared financial details, contact your bank immediately and use Scamwatch's reporting guidance.
Checking your wider exposure
A ProtectMyData exposure scan checks available evidence linked to the email address you choose to submit. It is not definitive proof that you were, or were not, affected by an incident discussed here. A result from another breach does not establish involvement in this one.
Removing information from public websites or data brokers can reduce public exposure. It does not erase breach records, recover stolen copies or replace account-security and fraud-recovery steps. Reading this article does not run a lookup. The optional scan requires you to enter an email and submit the form.
Timeline
Customer cohort identified
The retailer says affected customers date from before June 2025, according to ABC. This is not the start of the reported access window.
Reported unauthorised access
The customer email describes this period of access to the Retail Express system.
Retailer informed
Napoleon Perdis says it learned that the third-party service had experienced a cyber attack.
Scope confirmed to the retailer
The email says Retail Express confirmed the access window and approximately 339,055 affected records.
ABC publishes the customer warning
ABC reports the email, affected data categories and the retailer's statement that its current online store was not affected.
How this report was checked
How this report was checked
Sources were checked on 19 October 2026. The incident facts above come from ABC News's 17 October report, including its direct quotations from the customer email. We did not obtain that private email independently, and did not find an accessible standalone primary incident statement in the sources reviewed.
The customer-record figure, access dates, shutdown, payment-data finding and OAIC notification are therefore attributed to the retailer through ABC, not presented as independent forensic verification. We have not accessed leaked records or contacted customers or an attacker.
Update notes
19 October 2026: First report prepared from the sources listed below. Incident dates and source limitations are distinguished from this publication date.
Questions readers ask
Was the Napoleon Perdis website hacked?
The reported breach involved an older Retail Express customer-record system. The retailer said its current online store was not affected. These statements are reported by ABC from a customer email.
Is 339,055 an exact count of people?
No. The customer email refers to approximately 339,055 customer records. We have not verified a distinct-person total.
Can I delete my leaked purchase history?
You can ask the retailer about its handling of your information, but deleting an account cannot retrieve copies already obtained by an unauthorised party. Public-data removal does not erase breach records.
Sources
- Napoleon Perdis data breach affects 340,000 of the cosmetics company's clientsABC News Australia, 17 October 2026
- Learn about data breachesAustralian Cyber Security Centre, Consumer guidance, checked 19 October 2026
- Report a scamScamwatch, National Anti-Scam Centre, Consumer guidance, checked 19 October 2026
Published 19 October 2026. Last checked and updated 19 October 2026. We do not link to attacker material.
