Names, email addresses, student ID numbers and messages between users could all be affected by the breach.