A spokesperson for Ortho RI said the hacker obtained data for "a significant percentage" of patients prior to Sept. 7.