Up to 350,000 customers and staff could have had their information stolen in a ransomware attack.