Vast data breach may be worse than previously thought