Oz Hair and Beauty confirms data breach affecting customers

Australian beauty retailer Oz Hair and Beauty has confirmed a cybersecurity incident involving unauthorized access to its online purchase and order platform. The breach potentially impacts up to two million customers, with reports from the dark web leak site ‘xpl0itrs’ claiming access to approximately 2.1 million customer records.

The accessed data relates to purchases made before August 2026 and includes full names, email addresses, phone numbers, and purchase histories. This history may encompass transaction currencies, total spending, and location details such as city, state, country, and postcode. The company clarified that sensitive financial information, including credit card details, payment information, and invoice details, was not compromised during the incident.

Oz Hair and Beauty has initiated a forensic investigation and implemented containment measures with support from its cloud e-commerce platform provider. The company has reported the incident to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and the Office of the Privacy Commissioner in New Zealand. Moving forward, the retailer stated it is reviewing its cybersecurity posture and data retention policies to mitigate future risks.