Attackers stole a trove of sensitive data, including names, contact details, and health information. Affected customers can enroll for free protection by April 18.