<p>UK shoppers caught up in third-party security mess, and nobody knows whether the data was flushed away</p>