The data breach was limited to the 18,105 Welsh residents who have tested positive for COVID-19 between 27 February and 30 August 2020.