Customers’ names, credit or debit card numbers, expiration dates and security codes may have been accessed.