Chainalysis disclosed password hashes and live tokens were exposed after initially reporting only non-sensitive customer data was accessed.