Payment information is safe but the company says information stolen in this attack could be used for phishing later.