The data loss comes on top of the 77 million PlayStation accounts it has already said were jeopardized by a malicious intrusion.
The breach occurred April 16 and 17 - before the PlayStation break-in. About 10,700 direct debit records of customers in Austria, Germany, the Netherlands and Spain may have been stolen.
A further 12,700 credit or debit card numbers elsewhere outside the U.S. may also have been stolen, it said.
Sony says it shut service to Sony Online Entertainment games such as "DC Universe Online" early Monday morning.
