Australian cosmetics brand Napoleon Perdis has disclosed a data breach that, according to the ABC, affects about 340,000 clients. The company says it became aware of the breach in June.
What was accessed
According to the company, the information accessed includes customer names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories.
That combination matters. On its own, a purchase history looks harmless. Paired with a name, phone number and email address, it lets a scammer send a message that sounds exactly like a genuine order update, refund notice or loyalty offer.
If you or your staff are customers
- Treat unexpected emails, texts and calls about orders, refunds or prizes with suspicion, even if they mention real purchases.
- Do not click links in those messages. Go to the retailer’s website directly instead.
- Never give out passwords, one-time codes or card details to someone who contacted you first.
- Watch for scams that use your date of birth or address to sound convincing.
The lesson for every small business
Most businesses hold the same kind of customer data: contact details, order history, sometimes dates of birth. A few practical questions are worth asking this week:
- Do we need it? Data you never collect, or delete when you are done with it, cannot be stolen.
- Who can get to it? Make sure every account with access to your customer list, online store or CRM uses multi-factor authentication.
- Would we notice? Many breaches are found weeks or months after they happen. Logging and alerts help you find problems sooner.
- Do we have a plan? Under Australia’s Notifiable Data Breaches scheme, many businesses must assess a suspected breach and notify affected people and the OAIC. Knowing your obligations before an incident saves panic later.
None of this needs a big budget. It mostly needs someone to check that the basics are actually in place.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.