The government said medical data of 500,000 people was affected but no personally identifiable information had been made available.