Customer name, credit or debit card number, and the card’s expiration date and CVV (the three-digit security code) were breached, the retailer said.