The flaw apparently exposed accounts, and the cards and bank links attached to them.