Customers who made purchases from the U.S. website may have had data exposed to an unidentified third party.