The NPC said the subjects of the ransomware attack at S&R were its 22,000 customers, compromising their dates of birth, contact numbers and gender.