Question: We have a small business website that has been compromised. They are somehow getting customers order details and contacting them requesting their credit card details. We have had our web team and a third party IT company looking into it and we can't find out where the breach is. 

There seems to be no suspicious access on the database, and none of the website code seems to have been altered.

There are also no new admin users and no unexpected logins from existing user profiles in the logs. We have changed all passwords we can think of but they still seem to be able to get the order details. This guy had the same problem back in April (exactly the same, even the same name used Lucy Whetton) but he hasn't posted what the solution was.

[Email phishing scam asking customers for card details](https://security.stackexchange.com/questions/85999/email-phishing-scam-asking-customers-for-card-details)

Does anyone have any ideas?

By the way, we have and are contacting all customers immediately to tell them not to respond to these phishing emails.

Answer: 
What troubles me is that you mention there was [another user](https://security.stackexchange.com/questions/85999/email-phishing-scam-asking-customers-for-card-details) affected by an attacker using the very same name "*Lucy Whetton*".

Are you by any chance using some standard well-known eCommerce website solution (or a custom one relying on some common framework)? Have you applied the latest available updates?

My guess is that the group behind this pseudonym knows of a security flaw affecting the web application you are using, and is scanning the web to find websites still using a vulnerable version.

In case of doubt, if you already had the latest updates available applied, you should get in touch with the software editor.
One of the things left to do would be too lookup for known security flaws on the XCart version you currently have. You mentioned that that is the e-commerce manager you are using and that you didn't update it to the latest version. Now, I am not sure which version you still use, but try to make a Google search to see if there are any disclosed exploits for it. By having a look myself I found, for instance, an [SQL Injection vulnerability](https://www.exploit-db.com/exploits/11404/) that could well be the cause of the problem. In those cases you wouldn't see new users, malicious code and so on, but simply "legitimate" SQL queries to you DB.