According to the AG's office, the "cyber incident" exposed personal information, including social security numbers.