Lush website hack 'exposes credit card details'

Cosmetics co throws out baby with bubbly bathwater

By John Leyden, 21st January 2011

Updated Luxury cosmetics firm Lush has ditched its UK website in response to a sustained hacking attack which left users vulnerable to credit card fraud.

The firm warns that credit card details submitted to the Lush.co.uk site between 4 October and 20 January may have been compromised by the assault by unknown hackers. Customers are advised to contact their bank as a precaution.

Lush wrote to its customers about the problem via email, copies of which were forwarded to us by several Reg readers. One reader reports that the credit card of a friend who had bought goods from Lush was subsequently used in a failed attempt to fraudulently purchase electrical goods online, anecdotal evidence that suggests the risk of fraud arising from this breach is far from theoretical.

E-commerce outlets sometimes suspend their website upon the discovery of a security compromise, restoring them once it's decided that underlying problems that might have allowed an attack have been fixed. Lush has gone much further than this and decided to "completely retire" the present version of its website.

"Our website has been the victim of hackers," a statement on Lush's soon-to-be-abandoned website explains. "We refuse to put our customers at risk of another entry - so have decided to completely retire this version of our website."

The cosmetics retailer plans to launch a completely new website, one that initially at least will only accept PayPal payments.

Lush's shops and mail order systems, run separately and not affected by the hack, will continue to trade as normal. UK-based Lush maintains multiple country specific websites throughout Europe, the US and parts of Asia. All appear to be trading as normal.

A quirky statement on Lush's UK website, which links to a video ad promoting Lush and featuring glove puppets, concludes with a message to the unknown hackers. "If you are reading this, our web team would like to say that your talents are formidable. We would like to offer you a job - were it not for the fact that your morals are clearly not compatible with ours or our customers," it said.

In a statement, Lush admitted it had first became aware of attacks on its site in December but only acted to pull its UK site out of commission following a second series of attacks earlier this month.

We became aware late December 2010 that www.lush.co.uk had been the subject of attacks by hackers. Our customers’ security is of paramount importance to us and as soon as we realised this was the case, we immediately took down our UK website and a thorough investigation followed and extra security measures put in place.
24 hour monitoring has shown that another attempt to hack our UK site has been made and again, we have taken down our UK website as a precaution.

Any customers who have placed online orders via www.lush.co.uk between 4th October 2010 – 20th January 2011 and are concerned should contact their card issuer for advice on monitoring their account for unusual activity. Customers who have used cards with us in our shops or via fax or phone are not affected.

We are horrified that this has happened, we understand the distress of those affected and we appreciate our customers’ continued support while we resolve the matter. We will be continuing to work with our credit card acquirer to carry out a full investigation in to this hacking attempt.

Lush's statement leaves plenty of questions unanswered, not least how many records were exposed by the attack and what went wrong with its UK site. The continued operation of multiple country-specific sites by Lush sits oddly with its decision to ditch, rather than just suspend, its UK site.

It remains unclear how many records were exposed by the attack. ®

Steps to Take Before Choosing a Business Continuity Partner