American customers’ statement and transaction histories have been exposed.