{"id":"oz-hair-beauty-customer-breach-aug-2026","category":"breach","status":"closed","title":"Oz Hair and Beauty customer data published with about two million email addresses","tldr":"Published Oz Hair and Beauty data contained about two million email addresses and customer details. The retailer says passwords and payment information were excluded. Watch for convincing fake retailer messages and contact the company directly.","summary":"Oz Hair and Beauty confirmed unauthorised access to its online purchase and order platform, involving customer information connected to purchases before August 2026. Have I Been Pwned reported about two million unique email addresses in published data, alongside names, phone numbers, locations and purchase information; the retailer has not confirmed that count. The company says passwords, credit card details, payment information and invoice details were excluded. It began notifying customers on 19 August and says it introduced containment measures with its e-commerce provider, secured its systems and reported the incident to Australian and New Zealand authorities. Its statement says customers can continue using its website and app. As of 3 November, no later public investigation conclusion, recovery of the published data or charges were found in the sources checked. Whether the exposed information has subsequently been used for scams is unknown.","action":"Check for the retailer's breach notification and be cautious of messages referring to your purchases. Open the retailer's website yourself to contact support; its notification should never ask you to follow a link to enter passwords or payment details. The company says those details were not exposed, so this incident alone does not call for replacing your card or changing your password.","product":"Oz Hair and Beauty online shopping service","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["oz-hair-and-beauty","data-breach","retail","australia","new-zealand"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Important Update About A Cyber Incident","url":"https://ozhairandbeauty.nz/pages/official-statement-regarding-cyber-incident","by":"Oz Hair and Beauty","date":""},{"kind":"research","title":"Oz Hair and Beauty Data Breach","url":"https://haveibeenpwned.com/Breach/OzHairAndBeauty","by":"Have I Been Pwned","date":"2026-08-19"},{"kind":"news","title":"Exclusive: Oz Hair and Beauty confirms cyber incident","url":"https://www.cyberdaily.au/security/14061-exclusive-oz-hair-and-beauty-confirms-cyber-incident","by":"Cyber Daily","date":"2026-08-18"},{"kind":"news","title":"Oz Hair & Beauty suffers online data breach","url":"https://internetretailing.com.au/oz-hair-and-beauty-suffers-online-data-breach/","by":"Internet Retailing","date":"2026-08-21"},{"kind":"news","title":"Oz Hair & Beauty hit by data breach, customer names and contact details exposed","url":"https://www.smartcompany.com.au/retail/oz-hair-beauty-data-breach-customer-names-contact-details-exposed/","by":"SmartCompany","date":"2026-08-24"}],"started":"2026-08-18","closed":"2026-08-24","created":"2026-11-03T20:33:29.354Z","updated":"2026-11-03T20:33:29.354Z","cve_notes":[],"timeline":[{"at":"2026-08-24","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"A company spokesperson told SmartCompany that credit card details, passwords, payment information and street addresses had not been accessed. This contradicted the attackers' earlier claim that home addresses were included.","url":"https://www.smartcompany.com.au/retail/oz-hair-beauty-data-breach-customer-names-contact-details-exposed/","by":"SmartCompany","patch":null},{"at":"2026-08-21","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Internet Retailing reported that the company was notifying affected customers and had contacted Australian cyber security and privacy authorities. The company said its investigation remained ongoing and did not confirm an affected-customer count.","url":"https://internetretailing.com.au/oz-hair-and-beauty-suffers-online-data-breach/","by":"Internet Retailing","patch":null},{"at":"2026-08-19","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"The retailer emailed customers about the breach on 19 August, according to SmartCompany's subsequent report.","url":"https://www.smartcompany.com.au/retail/oz-hair-beauty-data-breach-customer-names-contact-details-exposed/","by":"SmartCompany","patch":null},{"at":"2026-08-19","added":"2026-11-03T20:32:12.437Z","kind":"other","text":"Have I Been Pwned added the breach, reporting about two million unique email addresses in published data alongside names, phone numbers, suburbs, postcodes and purchase information.","url":"https://haveibeenpwned.com/Breach/OzHairAndBeauty","by":"Have I Been Pwned","patch":null},{"at":"2026-08-18","added":"2026-11-03T20:32:12.437Z","kind":"disclosed","text":"Cyber Daily reported that xpl0itrs claimed to have stolen 2.1 million customer records. Oz Hair and Beauty said its initial investigation pointed to data held by a third-party provider.","url":"https://www.cyberdaily.au/security/14061-exclusive-oz-hair-and-beauty-confirms-cyber-incident","by":"Cyber Daily","patch":"na"}],"url":"https://hard.fyi/live/oz-hair-beauty-customer-breach-aug-2026/","json":"https://hard.fyi/api/live?id=oz-hair-beauty-customer-breach-aug-2026"}