Lush A/NZ credit card details pilfered by "hackers"

Powered by SC Magazine
 

Database stolen, PCI DSS rules flouted.

Soap retailer Lush has urged customers in Australia and New Zealand to cancel their credit cards after revealing the brand's local websites were breached.

It pulled its websites offline today and replaced them with a "privacy breach" message indicating that online shoppers' personal information "may have been obtained by the hackers".

Lush Australasia director Mark Lincoln later told ABC News that the company's online customer database had been stolen.

He also told ABC News that customers were not informed that their credit card details would be retained by the company and stored in a database. 

The Payment Card Industry compact to protect cardholders and their banks known as PCI DSS sets basic rules for accepting, storing and handling credit card details. These included keeping the credit card numbers for only as long as is necessary, usually just the time it takes to complete the transaction, and encrypting data as it is transmitted and when it is at rest.

Many online stores use merchant gateways or an intermediary such as PayPal and never see the cardholders' details.

It was unclear if Lush was in breach of its online merchant agreement and would face sanction from its issuing financial institution.

click to view full size image

"Lush is working with the police, forensic investigators and banks and doing all that we can to investigate the breach of privacy," it said.

"We are currently in the process of contacting each of our online customers individually by email."

Lush said it was in the process of carrying out "further security checks" in a bid to determine the extent of the breach.

However, it denied the hack was linked to an attack on the retailer's UK website in late January, other than to say that its site had also been targeted by hackers.

- additional reporting by Nate Cochrane

Copyright © iTnews.com.au . All rights reserved.


Lush A/NZ credit card details pilfered by "hackers"
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  26%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 337

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  57%
 
No
  43%
TOTAL VOTES: 140

Vote