The charity CRM provider told customers to assume all stored data, including attachments, was downloaded.