The breach affected anyone who received a loan through the company or inquired about a loan product through a third party.