Customers’ names, addresses, payment card numbers, expiration dates and security codes were exposed.