Depending on how they hacked it, if they get access to the server, they have access to all the data. If they can change the page, it’s pretty safe to say that they at least have access to the admin of the software, which would give them complete user info…..