The cosmetics retailer, which counts 41 million customers in its membership data, declined to provide an accurate total number of customers affected.