2.5 million people were affected, in a breach that could spell more trouble down the line.