Napoleon Perdis breach: about 339,000 customer records accessed
Napoleon Perdis said an unauthorised party had access to customer records held by its third-party provider Retail Express between November 2025 and June 2026, and that about 339,055 records were accessed, including names, dates of birth and contact details.
What happened
Napoleon Perdis notified customers of a data breach at Retail Express, the third-party provider it used to store customer records. The company said it was informed in June 2026 that Retail Express had suffered a cyber attack, and that an unauthorised party had access to the system between November 2025 and June 2026. The company said the incident has been contained and the system has been permanently shut down, and that its current online store was not affected. The company’s notification to customers was reported on October 17, 2026.
Who is affected
Customers from before June 2025 — about 339,055 customer records. The information accessed includes customer names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. Napoleon Perdis said the compromised system did not hold bank account or card details, and did not hold passwords for its online store. The company said the Office of the Australian Information Commissioner has been notified.
How serious
The concrete risk is targeted phishing and impersonation: a name, date of birth, home address, phone number and purchase history in one record is enough for scammers to pose as Napoleon Perdis — or as a bank or delivery company — with details that check out, and dates of birth and home addresses cannot be changed the way a password can. Because the company says no bank, card or password data was held on the system, direct card fraud and store-account takeover are not the immediate risks; convincing scam calls and messages are.
What to do now
Napoleon Perdis advised customers to remain vigilant against scam calls or emails impersonating the company and to monitor their bank transactions. Treat any message or call that cites your purchases or this breach and asks for passwords, codes or payment details as suspect, and contact the company through its official site or stores rather than any link or number in the message.
Sources: ABC News Australia reporting, via Zot News · The Hacker in a Hoodie Index