Cashalo confirms data breach, NPC investigates