The credit reporting agency said the breach was "limited to specific data elements" and didn't include credit reports or core credit information.