Oz Hair and Beauty data breach: what happened and what to do

What happened

Oz Hair and Beauty is an Australian online beauty retailer. On August 18, 2026, Cyber Daily reported that a group called xpl0itrs had listed the retailer on its leak site, claiming about 2.1 million customer records. The group later published the data it said it had taken.

The retailer first said the claim related to data held by a third-party provider. On August 20 it told customers that its online purchase and order platform had been briefly accessed by an unauthorised third party. In its official statement, the company said affected customers would be contacted directly, and that anyone who had not been emailed by Saturday, August 22, had not been identified as affected.

How many people

Have I Been Pwned counted 1,988,331 unique email addresses, about 2 million. The attacker's own claim was 2.1 million records. The company has not confirmed how many customers it considers affected.

What was exposed

Have I Been Pwned lists email addresses, geographic locations, names, phone numbers and purchases. The locations are suburb and postcode, not full street addresses. The company's statement says the information relates to purchases made before August 2026 and includes full names, email or mobile contact details and purchase history, and that it does not include credit card details, payment information or invoices.

What that lets criminals do

Without payment data or passwords, the realistic harm is targeted scams. A criminal holding your name, mobile number, suburb and what you bought can write as the retailer or a courier with a "problem with your order" or "your refund" message. Australia has seen plenty of scam texts built on retail data, and a message that mentions a real purchase is more likely to be believed.

Your suburb and postcode narrow down where you live without giving the full address, so a letter or a doorstep scam is less likely than a call or text.

The company's response

Oz Hair and Beauty confirmed the incident to customers and reported it to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner and the Office of the Privacy Commissioner in New Zealand. It says it will contact affected customers directly. If you were not emailed by August 22, the company says your information was not identified as impacted, but Have I Been Pwned's list may still include your address.

If you shopped at Oz Hair and Beauty

Search your email on Have I Been Pwned, and read any email from the retailer through its own website instead of a link. Be wary of unexpected texts that mention an order.