Australian cosmetics retailer Oz Hair and Beauty confirmed a cyber security incident following an extortion attack by the threat group 'xpl0itrs', who exfiltrated and leaked customer database records online. The compromised dataset affected nearly 2 million accounts and exposed full names, email addresses, phone numbers, geographic locations (suburbs and postcodes), and order transaction metadata (currency, total spend, and purchase details). Oz Hair and Beauty confirmed that passwords, credit card numbers, payment processing details, and identity documents were not stored in the affected database and remained uncompromised. The retailer launched an incident response investigation, issued regulatory notices, and advised customers to remain vigilant against phishing campaigns.