Mixture
From the reports that I have herd (BBC R4); Name and address + date of birth details and login password have been lost; commencing from February 2014.
If this is the case, i would contend that the statement "No financial data has been lost" is open to question. What personal details do you need to open a Credit card A/C ?
Was the "personal data" of their customers held as plain-text on their servers ? or was encryption used ?
The whole Internet retail industry is increasingly looking to be a Retail-Fest devoid of integrity.
[Edit:Give me a reason why a vendor would want your Date of birth ! outside Marketing Profile reasons i.e. not a valid reason]
CAT III