Australian cosmetics brand Napoleon Perdis disclosed a data breach impacting approximately 339,055 customers resulting from a third-party cyber attack on Retail Express, a service provider used to store customer records. Investigations confirmed that an unauthorized party maintained access to the environment between November 2025 and June 2026, compromising customer names, dates of birth, email addresses, phone numbers, postal addresses, and purchase histories. Payment card data was unaffected, and the incident was formally reported to the Office of the Australian Information Commissioner (OAIC).