In a statement to shareholders, the financial services group said a ‘third party unlawfully accessed a limited portion of data of a subsidiary of the group’.