Three months on, the Information Regulator is still establishing how many insurers the MIP breach affected.