Incident contained within 9 hours resulted in unauthorized access to staff names, mobile phone numbers