This allowed the attackers to gather customer names, address, phone numbers, credit card details, and login information.