Welltok, owned by Virgin Pulse, revealed the numbers of people affected by the incident in separate filings with Maine and federal regulators.
The breach, previously disclosed in late October, was part of the mass-hack of the MOVEit file transfer system.