The company says the breach stems from a system containing customer data “relating to some online orders placed between November 2018 and October 2020” and that customers are at risk from scammers.