Bought a lipstick or a palette from Napoleon Perdis a few years back? Your details might be floating around.
Around 339,000 customer records got caught up in the Napoleon Perdis data breach, the ABC reports. Names. Birthdays. Phone numbers. Home addresses.
Card numbers? Not in there, the company says. Small mercy.
Wasn’t even their own system
Here’s the twist. Hackers didn’t get into the Napoleon Perdis website.
They got into Retail Express. That’s the outside company the brand used to keep customer records. Napoleon Perdis found out about it in June.
Then in August came the really ugly bit. Retail Express said the hackers had been sitting in there from November 2025 until June 2026. Seven months, give or take.
Shopped with them before June 2025? You’re the group affected.
So what did they get?
Names, dates of birth, emails, phone numbers, postal addresses. Purchase history too.
“This system did not hold your bank account or card details, or the password for your napoleonperdis.com account,” the company told customers.
Today’s online store is fine, it says. And that old system? “Permanently shut down.”
Already out there?
Possibly. Back in June, a hacker calling themselves “2019” bragged on a hacking forum about having 339,100 Napoleon Perdis customer records, Cyber Daily reported. The data was reportedly posted for free.
Nobody had confirmed it back then. But look at the numbers. 339,100 versus 339,055. Pretty much a match.
The privacy watchdog, the OAIC, has been told.
No card numbers. Still a problem.
Easy to shrug off, right? Wrong.
Think about it from a scammer’s side. Your name, birthday, mobile, email and street address, all in one spot. Add what you bought and when. Now they can ring you up sounding like the real deal.
“Hi, it’s about your order from 2023.” See how that works?
Customer? Do this
Get a call, text or email “from Napoleon Perdis”? Don’t click anything. Head to the website yourself.
Check your bank account every so often. The company suggests that too.
Anyone who knows a bit too much about you should ring alarm bells. That’s usually how it starts.
Still using an old password from years back? Change it. Passwords weren’t in this lot, apparently, but old ones get reused and that’s never great.
Worried someone’s using your identity? IDCARE can help, free of charge.
Sydney born and bred
Makeup artist Napoleon Perdis started the brand in Sydney back in 1995. Plenty of Aussies have handed over their details at the counter over the years, usually for loyalty points.
That’s what stings. You trust the brand. Then you find out some other mob had your info all along.
Where to from here
The old system’s gone, the company says. Fair enough.
If you’re one of the 339,000? Stay sharp for a while. Dodgy call? Weird text? Hang up. Delete.