Personal data of up to 3,700 Afghans have potentially been exposed after a cyber-attack on a company working with the MoD.