The credit reference agency now admits that this year’s huge data hack exposed some customers to “possible criminal activity”.