A Norfolk Admirals fan notified the Admirals last week that his information was posted online. Another customer found out that her information was posted online from the service Have I been Pwned? Her son’s name and address were included because she had signed him up for the Admirals Kids Club several years ago.

According to the Admirals, a hacker posted several thousand Admirals customers’ names, addresses, email accounts and credit cards used (but not the credit card numbers) to purchase items through the Admirals website. Although the original number of customers affected was 4,476, the Admirals claim that after de-duplicating and eliminating spam email addresses, the actual number of customers affected is 250.

The alleged hacker said in an interview on Twitter that he had emailed warnings to the Admirals about inadequate security and that his emails were ignored. He also claimed that he had the team’s Twitter password but had not tried to get into the account.