Experts say the incident raises fresh questions about how long companies are retaining customer data for.