Ballad reports potential hack of personal information to third-party partner’s servers