The personal information exposed during the almost three-month period in which its systems were accessed includes medical ...