Information accessed in the incident included IRD numbers, addresses and bank details.