Monitoring products could have been used to compromise the servers of as many as 18,000 of its customers.