Privacy watchdog launches investigation as names, passport numbers, addresses and shopping history among information leaked.