The company says an independent contractor used his database access to steal employees’ personal information.