The exposed data came from an old system that stored information over two years old and no recent data is affected.