Question: We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a third party IT company looking into it and we can't find out where the breach is. 

There seems to be no suspicious access on the database, and none of the website code seems to have been altered.

There are also no new admin users and no unexpected logins from existing user profiles in the logs. We have changed all passwords we can think of but they still seem to be able to get the order details. This guy had the same problem back in April (exactly the same, even the same name used Lucy Whetton) but he hasn't posted what the solution was.

[Email phishing scam asking customers for card details](https://security.stackexchange.com/questions/85999/email-phishing-scam-asking-customers-for-card-details)

Does anyone have any ideas?

By the way, we have and are contacting all customers immediately to tell them not to respond to these phishing emails.

Answer: 
If you can't find the entry point of the hackers, and a "third party IT company" can't find it either, consider hiring a professional security firm to investigate the attack. 

This is not an appropriate forum for product or company recommendations, so please don't ask specifically "who" to hire. 

I have found that people who present at security conferences often work for reputable security firms, so you could start your searches there. Many places have regional conferences which might be better suited to offer you local assistance; there are national conferences, and even international conferences, all of which would provide access to many professionals.

Another approach is to contact your local law enforcement. While they likely won't have the resources or ability to investigate the hack directly, they may put you in contact with a national law enforcement agency who might have more resources; they might also offer the names of reputable security investigators you could hire.
One of the things left to do would be too lookup for known security flaws on the XCart version you currently have. You mentioned that that is the e-commerce manager you are using and that you didn't update it to the latest version. Now, I am not sure which version you still use, but try to make a Google search to see if there are any disclosed exploits for it. By having a look myself I found, for instance, an [SQL Injection vulnerability](https://www.exploit-db.com/exploits/11404/) that could well be the cause of the problem. In those cases you wouldn't see new users, malicious code and so on, but simply "legitimate" SQL queries to you DB.