Unknown attackers made off with a raft of PII, the Justice Department says — but witnesses in the protection program are still safe.