What happened

Australian cosmetics brand Napoleon Perdis has confirmed that personal information belonging to almost 340,000 customers was exposed. The breach did not start in Napoleon Perdis's own systems. It came through Retail Express, the third-party retail software platform the company uses.

Why it matters

This is a textbook supply-chain breach. Customers trusted the brand, but their data sat in a supplier's platform. Under Australian privacy law, the brand still carries responsibility for that data and for notifying affected people.

Supply-chain and third-party compromises were among the most common routes into organisations worldwide in October 2026.

How to protect your AWS environment

• Keep a register of every SaaS and supplier that holds your customer data.
• Share only the data each supplier truly needs, and review access every quarter.
• Build supplier breach scenarios into your incident response plan and notification process.

Source: Click to Read the original report (ABC News)