An unknown number of policyholders may have had their sensitive information stolen in the attack.