The company says ‘an estimated fewer than 550,000’ people’s credit card or bank information may have been accessed.