A security exploit may have revealed sensitive customer data, and that isn't the only embarrassing aspect for the company.