Biometrics, diagnoses, and bank details exposed in major healthcare breach