The Information Commissioner found cosmetics retailer Lush in breach of the Data Protection Act. Hackers were able to access the payment details of 5,000 customers. Lush only discovered the security issue in January after receiving complaints from 95 customers who had been the victim of card fraud. The company has signed an undertaking to ensure that future customer credit card data will be processed in accordance with the Payment Card Industry Data Security Standard (PCI-DSS) Lush has chosen an external provider to process all future payments.”]
Source: https://www.csoonline.com/article/2129242/lush-breached-data-protection-act–ico-confirms.html