The company says hackers ran malicious script on its website that was able to skim payment information for nearly two months.