Drug addiction treatment service admits attackers stole sensitive patient data