The company also has to restore customers’ stolen loyalty points.