The incident, first detected in January but publicly disclosed in May, compromised names, contact details, masked Social Security numbers, and government-issued ID images for nearly 70,000 users.