The cyber-attack meant the details of 7,757 people who had bought tickets to the museum’s exhibitions online were extracted by an unknown hacker.