The airline reports no card numbers or passwords were taken, with customer notifications underway plus two years of identity protection.
