At least 4 million at risk from data breach at US office