I haven't downloaded the dump files yet, but from what I can tell, their entire db was stolen. Meaning, customers' names, emails, addys, credit cards, etc. But most importantly, they were able to decrypt the customers' passwords back into plain text, too...