To date, the data thieves have pilfered more than 200,000 unique passwords, hundreds of credit card records, and more than 4 million harvested browser cookies.