The company also says it has evidence an encryption key used to secure the data was also stolen in the November hack.