They're currently admitting to losing passport #s, but what else - like credit card info which they aren't supposed to keep in any case - might have been compromised?