Australian retail giant Oz Hair and Beauty has confirmed a cyber security incident involving unauthorized access to its online e-commerce platform. The breach, which impacts customers who made purchases prior to August 2026, has prompted the company to urge vigilance against potential phishing scams.
Here is everything you need to know about what occurred, who is affected, and how to protect yourself.
What Happened
On Wednesday, Oz Hair and Beauty began notifying customers via email that an unauthorized third party had accessed its online ordering database.
The brand, which started in 1986, has grown into a major omni-channel retailer with 37 physical store and salon locations across Australia. Since launching its online store in 2012, digital sales have become a core driver of its business. The company employs roughly 500 staff and generated $100 million in revenue in the last financial year.
Because of its significant digital footprint, the security breach on its e-commerce platform has broad implications for Australian online shoppers.
What Data Was Compromised
According to emails sent to affected users, the compromised database contained specific personal and transactional records.
The exposed information includes:
- Full names
- Contact details (email addresses and/or mobile phone numbers)
- Order histories (including currency used and total spend)
- Broad location data (city, state, postcode, and country)
Importantly, Oz Hair and Beauty confirmed that personal financial information—including credit card details—was not accessed. The breach was contained to the transaction and ordering database rather than the primary payment processing gateway.
How the Company is Responding
Upon discovering the intrusion, the retail group immediately initiated containment protocols. The company collaborated with senior technical specialists from its cloud e-commerce platform provider to launch a comprehensive forensic investigation and secure the website.
In its communication to customers, the brand expressed regret over the incident and announced immediate plans to bolster its digital defenses. This includes reviewing data retention policies and upgrading its overall cybersecurity posture to mitigate future risks.
What You Should Do Next
While financial details remain secure, the exposure of names, emails, and phone numbers increases the risk of targeted phishing attacks and spam. Oz Hair and Beauty has urged its customer base to stay alert.
If you are an Oz Hair and Beauty customer, watch out for unsolicited communications requesting identity verification, payments, or passwords. Security experts recommend utilizing email spam filters, marking suspicious emails as spam, and verifying any unusual brand communications directly through official customer service channels.
