UK shoppers caught up in third-party security mess, and nobody knows whether the data was flushed away