Revelation comes as PwC retirement fund members learn additional personal data compromised in attack on outsourcer