Oz Hair and Beauty customer data published with about two million email addresses
Published Oz Hair and Beauty data contained about two million email addresses and customer details. The retailer says passwords and payment information were excluded. Watch for convincing fake retailer messages and contact the company directly.
Check for the retailer's breach notification and be cautious of messages referring to your purchases. Open the retailer's website yourself to contact support; its notification should never ask you to follow a link to enter passwords or payment details. The company says those details were not exposed, so this incident alone does not call for replacing your card or changing your password.
What’s happening
Oz Hair and Beauty confirmed unauthorised access to its online purchase and order platform, involving customer information connected to purchases before August 2026. Have I Been Pwned reported about two million unique email addresses in published data, alongside names, phone numbers, locations and purchase information; the retailer has not confirmed that count. The company says passwords, credit card details, payment information and invoice details were excluded. It began notifying customers on 19 August and says it introduced containment measures with its e-commerce provider, secured its systems and reported the incident to Australian and New Zealand authorities. Its statement says customers can continue using its website and app. As of 3 November, no later public investigation conclusion, recovery of the published data or charges were found in the sources checked. Whether the exposed information has subsequently been used for scams is unknown.
- What
- Breach
- Affects
- Oz Hair and Beauty online shopping service
- Fixed in
- Nothing to patch
- Since
- 18 Aug 2026
- Closed
- 24 Aug 2026
Timeline
- Update
A company spokesperson told SmartCompany that credit card details, passwords, payment information and street addresses had not been accessed. This contradicted the attackers' earlier claim that home addresses were included.
- Update
Internet Retailing reported that the company was notifying affected customers and had contacted Australian cyber security and privacy authorities. The company said its investigation remained ongoing and did not confirm an affected-customer count.
- Update
The retailer emailed customers about the breach on 19 August, according to SmartCompany's subsequent report.
- Update
Have I Been Pwned added the breach, reporting about two million unique email addresses in published data alongside names, phone numbers, suburbs, postcodes and purchase information.
- Made publicNothing to patch
Cyber Daily reported that xpl0itrs claimed to have stolen 2.1 million customer records. Oz Hair and Beauty said its initial investigation pointed to data held by a third-party provider.
Sources
- Important Update About A Cyber IncidentOz Hair and Beauty
- Oz Hair and Beauty Data BreachHave I Been Pwned · 19 Aug 2026
- Exclusive: Oz Hair and Beauty confirms cyber incidentCyber Daily · 18 Aug 2026
- Oz Hair & Beauty suffers online data breachInternet Retailing · 21 Aug 2026
- Oz Hair & Beauty hit by data breach, customer names and contact details exposedSmartCompany · 24 Aug 2026