40 million customers have been compromised