Details including criminal records, dates of birth, national insurance numbers and payment information may have been stolen in the attack.