Forty million credit cards were exposed to potential fraud in a security breach at a payment-card processor.