Information on gender, immigration status, bank account numbers and medical data all could be at risk