The company says the data was compiled using information stolen from other sites, not from Tesco itself.