The personally identifiable information of about 650,000 customers of JCPenney and other retailers is at risk after a data tape went missing from storage vendor Iron Mountain.