The UK website of cosmetics maker Lush has been hacked, and as a result, customer credit card information was stolen and subsequently used by the hackers. For customers who made an online purchase between October 2010 and January 20, 2011, their credit card information was put at risk while the site remained up taking orders while under attack. Those who placed online orders during this time are asked to contact their banks as their card details “may have been compromised.”

The company has issued a message on its international sites about the hacking with reassurance that the sites are run on separate servers and safe; they are posting updates to their Facebook wall regarding the issue, and meanwhile are continuing on with business as usual. Their main website has a placeholder of information regarding the compromised website with contact details; they are addressing concerns on Twitter and they are working with investigators to resolve the issue so that this doesn’t happen again.

In an announcement on its home page, it said: “We are very sorry to confirm that our website has been the victim of hackers. 24-hour security monitoring has shown us that we were still being targeted and there were continuing attempts to re-enter. We refuse to put our customers at risk of another entry – so have decided to completely retire this version of our website.”

Talking of its warning to customers, it said: “An October to January timeframe was decided because we wish it to cover a larger period than we think has been exposed. We hope we are erring very much on the side of caution.

“We would rather notify more customers than required, than find out in retrospect that we had narrowed it and missed people. Some of our customers have already experienced unauthorized use of their cards, so we still urge all customers in the above period to check statements and talk to their banks for advice.”