The company began notifying customers about the incident two weeks ago. Victims are being offered one year free credit monitoring and a 50 percent off coupon, good for another CitySights NY tour.

CitySights NY's parent company, Twin America, says that it has "taken several important steps to improve the level of its data security." It has locked down access to its servers and installed an application firewall in hopes of thwarting future attacks.

But clearly, there's room for improvement. The company included the 50 percent off coupon code in the breach notification letter that was posted to the New Hampshire Attorney General's website. The code is 012345.

The IDG News Service