The debt acquisition and credit servicing firm had 394,000 stolen, including material related to its direct customers and its loan book