Customers’ names, addresses, payment card account numbers, expiration dates and security codes may have been exposed.