Oz Hair & Beauty — Third-party compromise disclosed August 2026

New incident
Third-party compromise
Verified from two or more independent sources

What this record states

Oz Hair & Beauty has reported a data breach through a platform operated by a third party.

The source states that information about customers was involved.

No source consulted for this record states when the incident occurred.

The number of people affected has not been stated.

Record overview

Incident date: Not confirmed
Discovery date: Not confirmed
Disclosure date: 24 August 2026
Notification date: Not confirmed
People affected: Not stated
Who was affected: customers

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Categories of affected data

Not stated

Notifications and response

Regulators notified

Office of the Australian Information Commissioner

Law enforcement notified

Australian Cyber Security Centre

Legal and formal response

reported the incident to the Australian Cyber Security Centre

Technical and organisational remediation

Not stated

Official sources

Corroborating report

Oz Hair & Beauty data breach exposes customer names, contact details

smartcompany.com.auRetrieved 24 August 2026

View official source

Further official sources

Corroborating report

Oz Hair & Beauty suffers online data breach - Inside Retail Australia

insideretail.com.auRetrieved 22 August 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The record says Oz Hair & Beauty was investigating a third-party compromise that briefly exposed the names and contact details of some customers. The disclosure date is recorded as 24 August 2026, while the incident date, discovery date, notification date and public record date are not publicly established.

The number of affected people and the broader data categories are not publicly established. The record does establish that the organisation reported the incident to the Australian Cyber Security Centre and the Office of the Australian Information Commissioner. It does not establish the technical cause, the duration beyond the description of a brief exposure, any remediation, or whether a regulatory finding followed.

How Cleverer may have helped

For this kind of third-party exposure, clear supplier oversight, documented access controls, incident-response procedures, staff training and timely evidence of decisions may help an organisation understand what was exposed and demonstrate how it assessed and managed the event. Maintaining current records of notifications, containment steps, communications and remediation could make later review more reliable.

These measures would not mean the incident was necessarily preventable, and none of them guarantees that an incident, regulatory action or other consequence will not occur.