The breach was discovered by Mossab Hussein, a security researcher at SpiderSilk, a cyber security firm in Dubai, the report said. Hussein confirmed to CNN Business.
MoviePass customers are issued cards that function like debit cards. Customers pay a monthly subscription. MoviePass loads the full cost of a movie on theatrical release.
Hussein told CNN Business that when the data was discovered, he emailed MoviePass's CEO Mitch Lowe to report it. When he did not hear back after a few days, Hussein reached out to TechCrunch.
"ASAP, and as transparently as possible," said Hussein.
MoviePass said it would continue to disclose information about the incident.