Approximately 180,000 records containing PII and payment data were exposed.