Feeds

Lush website hack 'exposes credit card details'

Cosmetics co throws out baby with bubbly bathwater

The Power of One eBook: Top reasons to choose HP BladeSystem

Updated Luxury cosmetics firm Lush has ditched its UK website in response to a sustained hacking attack which left users vulnerable to credit card fraud.

The firm warns that credit card details submitted to the Lush.co.uk site between 4 October and 20 January may have been compromised by the assault by unknown hackers. Customers are advised to contact their bank as a precaution.

Lush wrote to its customers about the problem via email, copies of which were forwarded to us by several Reg readers. One reader reports that the credit card of a friend who had bought goods from Lush was subsequently used in a failed attempt to fraudulently purchase electrical goods online, anecdotal evidence that suggests the risk of fraud arising from this breach is far from theoretical.

E-commerce outlets sometimes suspend their website upon the discovery of a security compromise, restoring them once it's decided that underlying problems that might have allowed an attack have been fixed. Lush has gone much further than this and decided to "completely retire" the present version of its website.

"Our website has been the victim of hackers," a statement on Lush's soon-to-be-abandoned website explains. "We refuse to put our customers at risk of another entry - so have decided to completely retire this version of our website."

The cosmetics retailer plans to launch a completely new website, one that initially at least will only accept PayPal payments.

Lush's shops and mail order systems, run separately and not affected by the hack, will continue to trade as normal. UK-based Lush maintains multiple country specific websites throughout Europe, the US and parts of Asia. All appear to be trading as normal.

A quirky statement on Lush's UK website, which links to a video ad promoting Lush and featuring glove puppets, concludes with a message to the unknown hackers. "If you are reading this, our web team would like to say that your talents are formidable. We would like to offer you a job - were it not for the fact that your morals are clearly not compatible with ours or our customers," it said.

In a statement, Lush admitted it had first became aware of attacks on its site in December but only acted to pull its UK site out of commission following a second series of attacks earlier this month.

We became aware late December 2010 that www.lush.co.uk had been the subject of attacks by hackers. Our customers’ security is of paramount importance to us and as soon as we realised this was the case, we immediately took down our UK website and a thorough investigation followed and extra security measures put in place.

24 hour monitoring has shown that another attempt to hack our UK site has been made and again, we have taken down our UK website as a precaution.

Any customers who have placed online orders via www.lush.co.uk between 4th October 2010 – 20th January 2011 and are concerned should contact their card issuer for advice on monitoring their account for unusual activity. Customers who have used cards with us in our shops or via fax or phone are not affected.

We are horrified that this has happened, we understand the distress of those affected and we appreciate our customers’ continued support while we resolve the matter. We will be continuing to work with our credit card acquirer to carry out a full investigation in to this hacking attempt.

Lush's statement leaves plenty of questions unanswered, not least how many records were exposed by the attack and what went wrong with its UK site. The continued operation of multiple country-specific sites by Lush sits oddly with its decision to ditch, rather than just suspend, its UK site.

It remains unclear how many records were exposed by the attack. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.