Loading page…
Australian beauty retailer Oz Hair and Beauty had data on approximately 2 million customers exposed after an extortion attack by the group xpl0itrs in August 2026.
According to Have I Been Pwned, in August 2026 Oz Hair and Beauty was targeted in an extortion attack carried out by a group calling itself xpl0itrs. The company confirmed the cyber incident, and the attackers subsequently published data they claimed to have obtained from the retailer.
Reported by Have I Been Pwned, the published data included approximately 2 million unique email addresses along with customers' names, phone numbers, geographic locations (suburb and postcode), and purchase records.
Around 1.99 million customer accounts are reported to be affected. Given that Oz Hair and Beauty is an Australian retailer, the majority of those affected are likely based in Australia.
If you have shopped at Oz Hair and Beauty, be alert for phishing emails or SMS messages that reference your name, location, or past purchases. Consider using a unique email address for retail accounts going forward. Monitor your accounts for any suspicious activity, and be cautious of unsolicited contact that appears personalised using your details.