Two cashback sites leaked data of 3.5 million users