An “unauthorized party” may have accessed the names of users, the last four digits of credit card numbers, and more.