Oz Hair and Beauty, originally founded as an online, digital storefront of a family salon, is an omnichannel beauty retailer that specialises in premium haircare, skincare, makeup, wellness products, and more.
The company was listed on the dark web leak site of a new threat actor called “xpl0itrs”, which claimed to have stolen 2,100,000 customer records containing names, email addresses, home addresses, phone numbers and the last four digits of active gift cards.
At the time of writing, the threat actor has uploaded a link to download what it claims is the stolen data; however, the link appears to be broken.
Speaking with Cyber Daily, a spokesperson for Oz Hair and Beauty said an investigation revealed that the breach was of a third-party provider rather than directly on the business.
“We are aware of a claim made online regarding data relating to our company. As soon as we became aware, we instructed our IT provider to commence an investigation,” the company said.
“Our investigation to date indicates the claim relates to data held by a third-party provider. We are working with them urgently to understand the nature and extent of any data that may have been affected.
“We are committed to the protection of our customers’ personal information and will keep them updated with accurate and relevant information as we continue our investigation.”
The third-party provider is currently unknown.
Who is xpl0itrs?
Xpl0itrs is a new threat actor, or at least a new brand for a new threat group, having launched on 12 June 2026 and listing its first victim on 15 August. The group announced the launch of its dedicated leak site on 17 June.
The company to date has five victims, including Dynatrace, BMW, RapidFort, Oz Hair and Beauty, and an unnamed Italian school management platform.
Based on reports, the group shares large amounts of tooling, victims and initial access with the TeamPCP threat group, and focuses on supply chain breaches.
The group’s site said that it “no like government, like money, like freedom,” something that its most vocal member, “boxturtl”, has echoed, describing themselves as “purely for monetisation.”
Outside of what appears to be ransomware, the group sells initial access through its site. Reports also suggest it has breached a number of supply chains through compromises of Trivy, Checkmarx KICS, LiteLLM, and BitWarden CLI.
It also reportedly consistently exploited stolen PATs, OAuth tokens, and API keys to access and exfiltrate internal repository data. It then sells it to buyers as post-access enablement.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
