The personal information of nearly 19,000 people was leaked in the data breach, and only came to light last week following the lifting of a superinjunction.