Addresses, phone numbers, family connections all accessible; Privacy Authority was aware of issue a while ago; Shas says it took swift action to plug unauthorized access