NFA got hold of a membership list with names and addresses, that's all.  Also,  each candidate received a membership list sprinkled with different fake names so as to identify the origin of the leak.  The personal photo ID  (i.e. DL) sent in to authenticate each and every ballot contained additional personal info not stored nor needed on CPC databases which is why it was immediately shredded.