In August 2026, Australian beauty retailer Oz Hair and Beauty was hit by an extortion group known as xpl0itrs, which later published data allegedly stolen from the company. The exposed dataset covers roughly 1.99 million unique email addresses along with names, phone numbers, geographic details (suburb and postcode) and purchase history.
While no passwords appear to be included, the combination of email addresses, names, phone numbers and location data provides ample raw material for targeted phishing and social-engineering campaigns. Attackers frequently leverage such enriched profiles to craft convincing lures that can ultimately lead to credential theft and account takeover.
What to take away: Customer PII leaks like this feed downstream identity attacks. Organizations should treat exposed employee or customer emails as elevated phishing risk, enforce MFA, and watch for credential-stuffing attempts using leaked addresses.