The breach was caused by a hacker exploiting a vulnerability in a third-party application. Customer information such as names, phone numbers, postal and email addresses may have been exposed, but financial and password information remains unaffected.