The attack occurred between April 21 and May 16 and a "limited amount of data was potentially accessed and acquired," according to the Sioux Center university.