. . "The security breach, which occurred between July and September 2013, may have exposed such personal information as addresses, email addresses, phone numbers and dates of birth as well as card numbers, user IDs and bank account numbers." . . . .