Six years' worth of personal data at risk in National Lotter