Cosmetics firm "Lush" has website hacked.

I am not impressed by their handling of this. They became aware of the intrusions in the last week of December, didn't tell any of their customers until Wednesday, and didn't say anything publicly until yesterday.