The company said the data was released onto the dark web about two weeks ago, and officials are not sure yet whether the data originated from the company or a vendor.