Australian cosmetics brand Napoleon Perdis emailed customers that Retail Express, a third party it used to store customer records, was hit by a cyberattack. Napoleon Perdis says it was told in June, and that Retail Express confirmed in August that the unauthorized party had access between November 2025 and June 2026, affecting about 339,055 customer records. Customers from before June 2025 are affected; the data includes names, dates of birth, emails, phone numbers, postal addresses and purchase histories. The company says the system held no bank or card details or website passwords, its current online store wasn't affected, the old system has been permanently shut down, and the OAIC has been notified. Expect scam calls and emails that pose as the brand.