Users’ e-mail addresses, passwords, and the last four digits and expiration dates of their credit cards may have been accessed.