Some customers have complained on the retailer’s Facebook page that more than $1,000 had been taken from their accounts. The breach would typically involve orders being placed without the account holder’s knowledge, with the items then delivered to a nondescript postal address.

Source: The Guardian