Napoleon Perdis customer records published after breach at supplier Retail Express
About 339,000 Napoleon Perdis customer records were published free by an attacker in June. The company says a supplier, Retail Express, was compromised; customers were emailed in October. Expect scam calls and emails, and don't act on unexpected messages.
If you shopped with Napoleon Perdis before June 2025, treat unexpected calls, texts or emails mentioning the brand or your orders as suspect and don't click links. Check your bank statements, and contact the company directly using details from its official website.
What’s happening
On 9 June 2026 Cyber Daily reported that an attacker calling itself "2019" claimed to have stolen about 339,100 customer records from Australian cosmetics brand Napoleon Perdis and released them free on a hacking forum. The claimed data included names, postal addresses, mobile numbers, email addresses, loyalty points, transaction history and total spending. Later reporting says the company learned in June that its supplier Retail Express, a platform it used to manage customer records, had been attacked, and that Retail Express confirmed the details in August. Reported access ran from November 2025 to June 2026. Napoleon Perdis emailed affected customers, those with accounts before June 2025, in the week of 17 October. It says the system was contained and permanently shut down, held no bank or card details or website passwords, and that its current online store was not affected. It has notified the Office of the Australian Information Commissioner. The reports read do not confirm any formal investigation, and sources give about 339,055 to 340,000 records. Sources differ on fields: the later report lists dates of birth and purchase histories. Whether the data was misused is not confirmed, but published data invites scams.
- What
- Breach
- Affects
- Napoleon Perdis customer records (held by supplier Retail Express)
- Fixed in
- Nothing to patch
- Since
- 9 June 2026
- Closed
- 17 Oct 2026
Timeline
- UpdateNothing to patch
Napoleon Perdis emailed affected customers who held accounts before June 2025, and ABC News reported it. The company said the system was contained and permanently shut down, held no card, bank or website password data, and that it had told the OAIC. About 339,055 records were affected.
- UpdateNothing to patch
Retail Express, the third-party platform Napoleon Perdis used to manage customer records, confirmed the details of its compromise to the company in August 2026. Access by an unauthorised party ran from November 2025 to June 2026. (Exact day in August not stated.)
- Made publicNothing to patch
Cyber Daily reported that a threat actor calling itself "2019" listed Napoleon Perdis on a hacking forum, claiming 339,100 customer records and releasing them free. Napoleon Perdis had not yet responded.
Sources
- Exclusive: Napoleon Perdis allegedly breached following threat actor claimsCyber Daily · 9 June 2026
- Napoleon Perdis Breach Hits 339,055 CustomersTech Insider · 17 Oct 2026