Approximately 40 million customer names, credit or debit card numbers, expiration dates and CVV codes were stolen.