Names and addresses of 40 million registered voters were accessible as far back as 2021 after cyber-attack