Oz Hair and Beauty hack: was my name, email or phone number taken?

Oz Hair and Beauty has confirmed that an unauthorised party briefly accessed its online purchase and order platform, and that limited personal information of some customers was involved. The company says the information relates to purchases made before August 2026. It has not published a figure for how many people were affected. Customer notification emails and a statement on the company’s own website went out around 19–20 August 2026.

What the company says was accessed is full name, contact information (email address and/or mobile phone number), and purchase-history details: transaction currency, total spend, and broad location data (city, state, country and postcode). Credit-card details, payment information and invoice details were not accessed. Oz Hair and Beauty says it moved to contain the access with its e-commerce provider, is notifying affected customers, and has reported the matter to the Australian Cyber Security Centre, the Office of the Australian Information Commissioner, and New Zealand’s privacy commissioner.

Why “no card details taken” is not the whole story

Almost every report leads with what was not taken: no cards, no invoices, a brief window, “limited” information. That is true, and it matters. It is also the least useful part of the story if you actually shopped there.

If your record was among those accessed, someone has a named person, a way to reach them, a rough fix on where they live, and evidence they buy from this retailer and roughly how much they have spent. That is not a key to your bank account. It is a script. A text, email or call that uses your real name, mentions Oz Hair and Beauty, and refers to a spend or a suburb-level location you recognise will feel like the shop following up — not like a stranger guessing.

The company also did not lose street addresses. That sounds reassuring until you put it next to what did go: name, phone and/or email, city and postcode. That combination is often enough for a public people-search listing to fill in the rest — a street address, extra numbers, relatives, an employer. The breach did not have to include your front door for someone to find it.

Reports of a huge published file, and of extortion, have not been confirmed by the company. You do not need those claims to be true for the confirmed data to be useful to a scammer. The honest read is narrower and still serious: this is not “someone can drain your card.” It is “someone can impersonate the shop, or you, with details that already sound right.”

What to actually expect

• If the company thinks you were affected, you may get an email from Oz Hair and Beauty about this incident. That is the notice they said they would send. It is not a public list, and there is no reliable way for anyone else to tell you that you were, or were not, included.
• In the following days and weeks, unexpected emails, texts or calls that mention a refund, a problem with an old order, or this claimed breach itself. They may use your real name and enough purchase or location detail to feel genuine. The aim is usually a password, a one-time code, a card number, or a click.
• More junk mail and scam attempts to the email or mobile that was on the order, for a long time after the news cycle ends. That contact information cannot be made secret again.
• Not mystery charges on a card from this incident. The company says payment details were not accessed. Unexpected card activity would have a different cause and should be taken up with your bank as usual.

What you can and cannot fix

If your details were in what was accessed, they cannot be pulled back. Your name, the email and/or mobile on the order, the fact and size of those purchases, and that city/state/postcode data are out. No company, website or service can recall them. Treat that as permanent.

• Treat unexpected contact about an Oz Hair and Beauty order, a refund, or this incident as untrustworthy unless you started the conversation yourself through the company’s own website. Do not use phone numbers or links that arrived in the message.
• Do not hand over passwords, one-time codes, or card numbers in reply, even if the sender already knows your name or that you shopped there. That extra information is what they do not have yet.
• If you still have an account, open the site the way you usually do — type it, or use a bookmark — and read any notice there. Do not get there from an email.
• Look up your name on people-search and data-broker listings and remove what you can. A leaked shop record becomes much more dangerous when it is joined to pages that already list relatives, extra phone numbers, employers and previous addresses. Those listings, unlike the breached data, can actually be taken down. That is the lever that still works.