Attackers had four days to drink in names, addresses, emails and phone numbers