Oz Hair and Beauty says no cards were taken. What was taken is what scam calls run on.

The working requirement for a convincing refund call is not a card number. It is a detail the customer believes only the merchant could hold: the total spent, and the postcode the parcel went to ^[4]. Both are in the confirmed set, alongside the full name and the mobile number to call or text ^[3]. Card numbers are the one item in a breach that a bank can retire the same afternoon. A mobile number and a postcode stay valid for years.

The notice does not pretend otherwise. Oz Hair and Beauty told customers the accessed data included information that could be used in further fraudulent or unsolicited communications ^[6], and warned them to be wary of unusual calls or emails requesting information, payments or proof of identity ^[9]. That is a precise description of the attack the dataset supports, sitting in the same email as the line about financial details not being accessed ^[5]. Count the categories and the balance is one excluded against six confirmed ^[14].

The advice attached to it is narrower than the exposure. Customers were told to mark unwanted messages as spam through their email platform to reduce similar correspondence ^[10]. There is no equivalent button for the mobile numbers that were also in the set ^[3], which is the channel a smishing operator will prefer precisely because it is unfiltered and because the message can quote a real order.

On the mechanics of the intrusion itself, the notice says less. The company brought in senior technical specialists from its cloud e-commerce platform provider to run the forensic work and containment ^[7]. Whether the access route was the merchant's own configuration or something in the provider's stack is not addressed, and neither is the number of customers affected, the date of the access, or how long the unauthorized third party was in the platform ^[13]. "Briefly" is doing a lot of work in that sentence ^[1].

The scope statement is the part worth reading twice. Affected records are those tied to purchases made before August 2026 ^[2]. That is an upper boundary with nothing under it, so the population is whatever the order platform still held, and its size is set by retention rather than by the incident ^[15]. The company says it is reviewing and enhancing both its cybersecurity posture and its data retention policies ^[8]. Pairing those two is the honest part of the response: for order records old enough that no one would notice their absence, the only durable control is not having them. Everything else in the notice manages the consequences of holding them.

Notification is continuing, and the company says it is taking reasonable steps in line with its regulatory obligations ^[11]. The Cyber Express says it has asked for more detail and has not yet received it ^[12].