An investigation is still underway but initial signs indicate accounts registere before November 2016 were hit.