Hackers also accidentally leaked more than 184,000 stolen cards through an improperly secured backend server.