The regulator says information about firms and employees has been affected by a cyber-attack.