Details for 2.4 million users were exposed online for 22 days.