FullBeauty Brands data breach: employee files copied during a month inside the network

Date	Event
October 18, 2025	Earliest unauthorized access to the network, per the investigation
October 22, 2025	FullBeauty experiences the incident affecting parts of its internal network and starts securing it
November 14, 2025	The review finds employment-related information in the copied files
November 19, 2025	Last date of unauthorized access in the investigation's window
January 23, 2026	Report to Massachusetts (391 residents)

What happened at FullBeauty Brands?

The letter calls it a cybersecurity incident that affected portions of the company's internal computer network on October 22, 2025. FullBeauty says it moved to secure its network at once and opened an investigation with outside cybersecurity partners. The letter does not say how the intruder got in, whether ransomware was used, or whether a ransom was demanded.

The dates in the letter are unusual. The access window runs from October 18 to November 19, 2025, so it ends four weeks after the company found the incident. It also ends five days after the file review found employee data, on November 14. The letter does not explain the overlap.

Who got a letter from FullBeauty Brands?

Employees. The letter opens by saying FullBeauty recognizes the importance of protecting information entrusted to it by its employees. The files found to hold personal data were employment-related. Nothing in the letter says customer or shopper data was involved, and the Massachusetts record marks no card numbers or financial accounts. Whether former employees were included is not stated.

What information was exposed?

It varies by person, but the letter lists name, Social Security number and health plan enrollment information. Massachusetts marks Social Security numbers only.

Record	People	Data it marks
Massachusetts OCABR, report 2026-104 (January 23, 2026)	391	SSNs
FullBeauty letter (filed copy, date left as a template field)	Not given	Name, SSN, health plan enrollment information

Health plan details in a breach are a reason to read plan statements closely. The healthcare provider breach notice guide explains what to check on statements from a health plan.

What is FullBeauty offering?

A complimentary membership to Experian IdentityWorks, with credit monitoring and fraud protection. The number of months is a template field in the filed copy. The call center is at 844-354-0077, weekdays from 9 a.m. to 5 p.m. FullBeauty says it has added security measures for its network and will keep training employees on cybersecurity threats. For how these offers compare, see the credit monitoring guide.

What the documents leave open

• The total number of people notified across all states.
• How the intruder got in, and why the access window runs past the discovery date.
• Whether any customer data was in the copied files.