As many as 22,000 credit card numbers have been exposed via a defunct payment gateway.