The firm said “insufficient protection” meant customers’ details were made accessible for 10 months.