Shopclues.com - Leakage of personal info from customer database

My friend's sister received a courier from shopclues.com on the address provided to the shopping website which stated that she has won * lakh rupees as the prize. Also enclosed was a scratch card which when opened, said that she has won an additional ** lakh rupees. They were asking for the bank transfer charges so that they could transfer the prize to her account. My concern is that how did the scamsters manage to get hold of the customer's personal info (including name, mobile number and address). Is it because the company is selling the personal info of all customers to third parties or is someone employed by the company who has access to the customer database running this scam. I contacted shopclues.com and all they said it was a fake. There's no explanation as to how our sister's personal info got into the wrong hands. I feel this is a breach of privacy policy and need to be brought to justice.