Bitrefill said attackers accessed 18,500 purchase records, potentially revealing “limited customer information."