Data breach - but survey firm only