Investigators found that the retailer was storing nearly 20 years’ worth of payment card data on its e-commerce server in plaintext format, protected by only a password, which the attacker guessed.