Company statements on Lush Cyber Incident

In early January Lush was victim to a ransomware attack that temporarily shut down some of our internal computer functions in the UK&I.   Since then we have been working with external security specialists to investigate the incident, whose work is still ongoing.  In order to give peace of mind to our customers the forensic investigators can confirm that our Retail shops and eCommerce functions were not affected and that NO customer credit card details or customer information was accessed. The investigation is ongoing as we try to ascertain what internal business information and data may have been affected.  

Lush would like to thank our customers who have been very patient during the period where our customer care and inquiry functions were suspended – the team are doing all they can to get through the backlog and respond to you all.  We would also like to give a shout out to all Lush staff who did everything they could to keep the business moving whilst having limited access to the usual business computer systems.

Lush UK&I is currently responding to a cyber security incident and working with external IT forensic specialists to undertake a comprehensive investigation. The investigation is at an early stage but we have taken immediate steps to secure and screen all systems in order to contain the incident and limit the impact on our operations. We take cyber security exceptionally seriously and have informed relevant authorities.