The firm will not say whether that included credit card numbers but it has informed the data commissioner.