Napoleon Perdis confirmed about 339,055 customer records were caught up in a breach at vendor Retail Express, with emails, birth dates and purchase histories inside. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source. You signed up at a makeup counter. Your details ended up in a system run by a company you never dealt with.
Retail Express held the records. You never met Retail Express.
Picture the signup. A counter. A loyalty form. A promise of points and member pricing. Nobody mentioned a vendor. Nobody asked whether your birth date should live on a third party server.
That is where the records went. Retail Express, the outside firm Napoleon Perdis used to store customer records, held them. An unauthorised party got into that system and had access from November 2025 to June 2026. Customers had no relationship with Retail Express. No contract. No choice. No way to vet a system they never knew existed.
This is the part that should annoy you. The brand you trusted did not lose the file. A supplier you never heard of did. And the customer carries the risk either way.
One field in that file was yours to control. A unique email alias for the loyalty signup, forwarding to your real inbox, would have kept your real address out of the vendor system entirely. When the file spreads, the alias is all the attackers hold. A message lands on the Napoleon Perdis alias and the source is obvious at once. That is the leak-tracing mechanism doing its job. Shut the alias down and the channel goes dead while your real inbox stays clean. The set-up guide takes about two minutes.
A name, a birth date, and a receipt history
No card numbers leaked. Read that as good news for your bank balance. Then forget it.
Because the fields that did leak build something worse than a card charge. They build a convincing stranger.
Your phone rings. The caller knows your full name. Knows your birth date. Knows your home address. Knows the product you bought last autumn. Sounds like the company? Of course it does. It sounds like the company because it is reading your own file back to you.
That recital proves nothing. Those details are the leak. But most people have never been told that, so the recital works.
Napoleon Perdis warned customers to watch for scam calls and emails impersonating the brand. A caller reading your purchase history back to you is proving they hold the leaked file, not that they work for the company. Hang up, then go to the brand through its own site or app.
Email and text run the same trick. A message naming a real purchase, sent to the real address you used at checkout, slides past every gut check most people rely on. And the email address is what makes delivery possible. Names do not change. Birth dates do not change. Postal addresses move slowly. Phone numbers are painful to replace. The address you typed into a loyalty form was the one part of the record you could have made expendable. It is also the part the scammer needs most.
The Hacker in a Hoodie index frames the vendor pattern bluntly: months of access inside a system the cosmetics brand did not run. If you want the wider picture of how spammers get your email address, signups like this one sit near the top of the list.
June brought a forum listing. October brought a confirmation.
Keep these two events apart. They look alike. They might not be.
On 9 June 2026, Cyber Daily reported a threat actor using the handle "2019" had listed Napoleon Perdis on a hacking forum. The claim: 339,100 customer records. The post also said the allegedly stolen data had been released publicly for free.
The June post listed first names, postal addresses, mobile numbers, email addresses, loyalty points, the monetary value of those points, transaction history, total spending, customer price groups, customer ID details, account creation dates and latest record update timestamps.
Now the October figure: about 339,055. Forty-five apart. Field lists overlapping heavily. Tempting to merge them. Wrong to merge them.
No source says the two datasets are the same. The October company notice never mentions the June claim, the threat actor, or any public release. The June claim was an attacker claim, unverified then, unverified now. The October confirmation comes from the company itself. It stands alone.
Two readings remain open. Same data? Then the file has circulated for free since June, and October confirmed a leak that was already public. Different data? Then Napoleon Perdis suffered two separate exposures in one year with nearly identical counts. Either reading leads a customer to the same move. Act as if the data is out.
Two clocks ran at once
Dates first. Judgement later.
An intruder had access from November 2025 to June 2026. Roughly seven to eight months. Napoleon Perdis learned in June 2026 that Retail Express had suffered a cyber attack. Retail Express confirmed the access window to Napoleon Perdis in August. The customer notification was reported on 17 October.
Four months passed between the company learning of the attack and customers being told their records were in it. That gap is arithmetic from the reported dates. No source accuses the company of sitting on the news, and this piece does not either. Confirming a victim count of 339,055 takes work. Rushing it helps nobody.
Still. Count the cost of the gap in practical terms. While it stayed open, anyone holding the data held a head start on every victim. A scam call quoting your purchase history lands harder when you have never heard of a breach.
Then the second clock. Access ran for most of a year. The sources do not say when, or whether, anyone spotted it during that window. They say the company learned of the attack in June. June is when the window ends. You can draw your own conclusions about detection from that.
What the notice settles, and what it leaves open
The disclosure was reported on 17 October. Zot quotes the customer notification, and UA.NEWS relays the ABC News reporting on it. No company notice page turned up in the sources. The company side reaches us through the notification as quoted by Zot and the ABC reporting as relayed by UA.NEWS.
| Settled | Still open |
|---|---|
| Napoleon Perdis told customers about a breach touching approximately 339,055 records | Whether the confirmed data matches the June threat-actor claim |
| The vendor was Retail Express, the outside firm that stored Napoleon Perdis customer records | How the intruder got into the Retail Express system; neither company has said |
| Access ran from November 2025 to June 2026 | Whether the data moved further than the June free-release claim |
| The file held names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories | Whether anyone has misused the confirmed data; no source reports confirmed misuse |
| It covers customers whose records were stored before June 2025 | Why June 2025 is the cutoff; no source explains it |
| Bank and card details and online-store passwords were NOT in the system | The exact date of the customer email; it is undated in the sources |
| The current online store was not affected | |
| The incident is contained, and the affected system is permanently shut down | |
| The Office of the Australian Information Commissioner was notified |
Read the "not included" rows for what they are. Narrow reassurance. Nobody can run up your card from this file. But the file that did get out lets someone pose as Napoleon Perdis, or pose as you, with your own details as proof.
The company told customers to watch for scam calls and emails impersonating Napoleon Perdis, and to monitor bank transactions. Take the first half of that advice seriously. The second half matters less here, since no bank details leaked, but it costs nothing to keep an eye on statements anyway.
If your records were in the file
Six moves. None of them need the company to act first.
- Treat any message quoting your purchase history as suspect until proven otherwise. A caller or texter reading your own details back to you has proven they hold the file, not that they work for Napoleon Perdis. Hang up on the caller. Delete the text.
- Go to Napoleon Perdis yourself. Type the site or open the app. Never follow a link in a message about this breach. The phishing wave will borrow the incident notice's own wording, and it will look exactly like the real thing.
- Lock down your email. Leaked names, birth dates and phone numbers feed account-recovery flows. Two-factor authentication on your email is the part an attacker cannot talk their way past. Switch it on if it is off.
- Expect recovery attempts. If a password reset you did not ask for shows up, treat it as part of this breach until proven otherwise. Do not approve it. Do not click through it.
- Check Have I Been Pwned once this incident is listed, and switch on its breach notifications. The next one should find you, not the other way around.
- Walk the breach-response order of operations. It covers the phishing tricks that use a leaked email in the order you actually need them.
Three questions the investigation still owes you
First, how did the intruder get in, and did other Retail Express customers get hit too? A vendor system holding one retailer's records usually holds more than one. Silence on that front helps nobody.
Second, does anyone tie the June threat-actor claim to the October confirmation with evidence, not arithmetic? A 45-record gap proves nothing. Evidence would.
Third, does the dataset surface in a form anyone can verify? That would turn a contained vendor incident into a circulating one. The notice gave customers a warning. The answers are still owed.
