Xperthair Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 16 August 2025, the Irish cosmetics retailer Xperthair appeared on a listing by the ransomware group qilin. Public records state that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and full details of what was taken have not been independently confirmed.

For anyone who has bought hair or face products from the company, the practical stakes are straightforward: personal details that retailers normally hold for orders and accounts could now be in the hands of criminals. That raises ordinary risks of phishing, identity misuse or unwanted contact, even while the exact scope stays limited in public reporting.

Inside the incident

According to the available record, Xperthair was listed by the qilin ransomware group on 16 August 2025. The report states that internal files were exfiltrated during a ransomware attack. No figure for the number of people affected has been published, and the precise timing of the intrusion, the technical method used, or the volume of data taken are all undisclosed.

A partial summary associated with the listing describes Xpert Professional, Ireland, as a well-known seller of hair and face cosmetics and addresses customers directly, claiming that information such as name, home address and date of birth may be involved. Because this appears as part of the group’s claim rather than an independent verification, it should be treated as an unverified assertion. No further confirmed inventory of files or systems has been released in the public facts.

Inside qilin

Qilin is a ransomware operation that has been active for several years and is widely documented as a ransomware-as-a-service group. It typically encrypts victim systems and simultaneously steals data, then threatens to publish the material on a dedicated leak site if a ransom is not paid. The group has previously listed organisations across multiple sectors and countries, often posting samples or descriptions of stolen files to increase pressure.

In this case the group claims to have listed Xperthair after an attack that involved exfiltration of internal files. No additional statements from qilin about this specific victim—beyond the listing itself—appear in the public facts, so any further characterisation of their demands or proof remains unconfirmed.

Who is Xperthair?

Xperthair, also referred to in the record as Xpert Professional, is an Irish company that sells hair and face cosmetics. It is described as one of the better-known retailers of that kind in the country. Like most consumer cosmetics businesses, it would normally maintain customer order records, delivery addresses, contact details and possibly loyalty or account information in order to process sales and fulfil deliveries.

A breach at a retailer of this type is consequential because the data it holds is personal and often linked to real-world identities and home addresses. Even without a confirmed count of affected individuals, the mere listing raises the possibility that ordinary shoppers’ details have left the company’s control.

What was likely exposed

The public facts name only “internal files exfiltrated in ransomware attack.” No complete inventory of those files has been released. The associated summary claims that customer information—name, home address and date of birth—may be among the material, but the text is truncated and the claim has not been independently verified. Exact contents therefore remain unconfirmed.

Organisations that sell cosmetics typically store order histories, shipping addresses, email addresses, phone numbers and payment-related records. Whether any of those categories were present in the files allegedly taken from Xperthair is not established by the available record.

The real-world impact

For individuals, the main risks are the usual ones that follow any retailer data exposure: targeted phishing emails or messages that appear to come from the company, attempts to use personal details for identity fraud, or unwanted marketing and scams that exploit knowledge of past purchases. Because the number of people affected is unknown and the precise data types are unconfirmed, it is not possible to say how widely these risks apply.

For the organisation itself, the listing creates reputational pressure, potential regulatory scrutiny under data-protection rules, and the operational cost of investigating and containing the incident. Public facts do not state whether systems remain encrypted, whether a ransom was demanded, or whether any recovery steps have been completed.

What to do if you're exposed

If you have shopped with Xperthair or Xpert Professional and are concerned your details may be involved, take these practical first steps:

• Watch for unexpected emails, texts or calls that reference recent cosmetic purchases or ask for passwords or payment information; treat them as suspicious.
• Change any password you reused on the retailer’s site and enable multi-factor authentication where available on other accounts that use the same email.
• Review bank and card statements for unfamiliar charges and consider a fraud alert with your financial institutions if you supplied payment details.
• Be cautious about sharing further personal information in response to unsolicited contact.

Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public detail on this particular incident remains limited, so continued caution is the most useful response until more verified information emerges.

AICompiled with AI assistance from public sources and published under our editorial standards.