A data sanitization process failed for 30 days, exposing 76,000 email addresses and 4,000 encrypted passwords.