Napoleon Perdis has confirmed a breach affecting about 340,000 of its customers, according to ABC News. If you have ever shopped with the cosmetics company, the question on your mind is probably the same one many readers are asking: Napoleon Perdis data breach what to do next? This guide explains what was exposed, why the combination matters, and the practical steps worth taking today.
What Napoleon Perdis says was exposed
The company says the accessed data includes customer names, dates of birth, email addresses, phone numbers, postal addresses and purchase histories. The source article does not say that payment card details or passwords were part of the incident, and we are not going to speculate about that. What is confirmed is the list above, and that list is already substantial.
It is worth being precise about scale. The reported figure is roughly 340,000 customers, so this is not a small slice of a mailing list. If you have an account or past order with the company, assume you may be included until you hear otherwise, and watch for any notification from Napoleon Perdis directly.
How this data enables phishing and SIM-swap fraud
No single item on that list is catastrophic on its own. The risk comes from the combination.
Convincing phishing. A scammer who knows your name, your address and what you bought can write a message that looks genuine. Imagine an email referencing a real past order and offering a refund, a loyalty reward or an "account verification" link. Purchase history is the detail that makes these messages feel authentic.
SIM-swap attempts. A SIM swap is when a fraudster persuades a mobile carrier to move your number to a SIM they control, which lets them intercept text-message codes. Carriers often ask for identifying details such as your name, date of birth and address to verify a caller. Having all three, plus your phone number, gives an attacker a head start on that conversation.
Identity fraud. Name, date of birth and address are the core ingredients many organisations use to confirm who you are. Even without financial data, they can be combined with information from other leaks to build a fuller profile.
This is also how stolen data tends to be used beyond the initial incident: as leverage and raw material for follow-on scams. For context on how stolen data fuels extortion, see our report on how Goodwin Procter paid $10M to Luna Moth hackers.
Steps affected customers should take now
You cannot take back data that has already been accessed, but you can reduce what anyone can do with it.
- Treat unsolicited messages with suspicion. Be wary of emails, texts or calls that mention Napoleon Perdis, an order, a refund or a prize. Do not click links. Go to the company's website by typing the address yourself, or contact it using details you already trust.
- Lock down your mobile account. Ask your carrier whether you can add a PIN or passphrase to your account, and whether it offers port-out or SIM-change protection. This directly targets SIM-swap risk.
- Enable two-factor authentication everywhere. Where possible, choose an authenticator app or a hardware security key over SMS codes, since SMS is the channel a SIM swap attacks.
- Use unique passwords. If you reused your Napoleon Perdis password on any other service, change it there now. A password manager makes unique passwords realistic.
- Use email aliases going forward. Signing up to shops with a dedicated alias limits how far one leak travels and makes it easier to spot which company leaked your address.
- Monitor your accounts. Keep an eye on bank statements, mobile account changes and any unexpected verification codes. Unprompted codes can signal that someone is trying to get into an account.
- Know your official channels. Follow any guidance the company issues, and consider checking whether your local privacy or consumer protection authority offers advice for breach victims.
Why retailer breaches keep reaching customer data
Retailers collect far more than they need to complete a sale: birthdays for promotions, phone numbers for delivery updates, purchase histories for personalisation. Each field is useful for marketing, and each becomes a liability if the database is accessed. Customer records often sit for years after a purchase, so a breach can reach people who have not shopped there recently.
That is why the most effective defence on your side is data minimisation. Give shops only what a transaction truly requires, use aliases where you can, and avoid supplying a real birth date when it is optional.
What This Means For You
If you are a Napoleon Perdis customer, the practical risk is not a stolen card but targeted deception. Messages that look personal may arrive in the coming weeks and months, and the details inside them may be accurate. Your phone number and date of birth also make your mobile account a more attractive target, so securing it is a priority. Nothing here calls for panic, but it does call for a few deliberate changes to how you handle unexpected contact.
Key takeaways
If you are asking Napoleon Perdis data breach what to do, start with these actions today:
- Enable two-factor authentication on your email, banking and mobile accounts, preferably with an authenticator app.
- Use a unique password for every account and change any that match your Napoleon Perdis login.
- Adopt email aliases for retail sign-ups to contain future leaks.
- Treat unsolicited messages about orders, refunds or rewards as suspicious until verified through an official channel.
- Add a PIN or extra protection to your mobile carrier account.
Breaches are rarely the end of the story for the people in them. Acting quickly takes away much of what scammers are counting on.
