Squirrel told clients an authorised user had gained access to a third-party system and taken personal information, specifically passport or driver’s licence details.