2026 Oz Hair and Beauty — online purchase platform briefly accessed; names, emails, phones and purchase details (HIBP 1.99M)
Data compromised
Limited personal information of some customers who purchased before August 2026: name, email and/or mobile number, purchase details (currency, total spend, purchase location, account creation date). The company says no credit card, password, payment or invoice details were included.
Technical writeup
Verified company statement (ozhairandbeauty.com official statement; customer email quoted by Cyber Daily, Aug 20, 2026). The online purchase and order platform was briefly accessed; the company worked with specialists from its cloud e-commerce provider. Notifications were sent to affected customers by email with a deadline of Aug 22, 2026. Regulators notified: Australian Cyber Security Centre, OAIC and the New Zealand Privacy Commissioner. The company says the website and app remain safe to use. Count not disclosed by the company; Have I Been Pwned lists 1,988,331 unique email addresses (added Aug 19, 2026). A threat actor calling itself xpl0itrs listed the company on its leak site claiming 2.1M records including the last four digits of active gift cards; the download reportedly failed, and the company says card data was not included. The gift-card claim is unverified. Access dates are not stated.
Root cause
Not disclosed in the company statement. The company says its online purchase and order platform was briefly accessed by an unauthorised third party; it began a forensic investigation and containment at once.