The hackers had access to the network for more than two months before detection, stealing biometric data that affected individuals cannot replace. The breach originated through an unnamed third-party vendor.