Funds and digital assets were not touched, but names, bank account details, and national ID numbers may have been exposed in what the company states was a wider global attack.