Third-party company with D51 experienced data breach