Second said no customer funds were affected and that it shipped a fix after identifying the attack within hours.