The company seemingly underestimated the severity of the breach after originally providing a head count of roughly 36,000 impacted individuals.