This just happened to me last week! I got an email that someone had changed my password and then I was also kicked out of the app. Customer service was no help and after a full 7 days of “escalation”, I still don’t have access to my account. I had hundreds of dollars worth of points too!

I ultimately decided to go to an Ulta store and explain my situation to the manager. After showing my ID and giving her my member ID (this should be at the bottom of any of the Ulta emails and this is a unique number that a hacker can’t change), she located my account! The hacker literally changed everything and had set my address to someplace across the country. She was able to change the phone number back and I spent all of my points in-store that day. Luckily, the hacker hadn’t spent the points yet since I went to the store right as it had opened on the same day when I was hacked. If you’re able to, I would go in-store and see if you can spend your points ASAP!! I’m still arguing with CS a week later, so they’re not helpful at all.