Retailer issues update after BBC contacted by cyber criminals who said this week's breach went beyond "basic contact details"