SEC now says personal info was leaked in breach