The case raises questions about how banking credentials were compromised and whether personal information associated with electoral applications was obtained through phishing or other means