The company has emailed affected users after a dark web source claims the data of almost 700,000 users was compromised.
Security researchers from Palo Alto Networks believe the likely Asia-based group is expanding its activities, which include sophisticated tools and techniques.