The breach includes personal data that was stolen from the company, it said in a public filing.