Six years’ worth of personal data at risk in National Lottery Community Fund data hack Third Sector