The breach occurred in November and a threat actor named “Dnacookies” is demanding $5,000 for the full dataset, which includes customers’ addresses, mobile numbers, and membership IDs.