The firm said 1.6 million documents had been accessed, including images that the company used to verify personal information.