The hacker claimed to be selling details of people’s passports, work permits, UK visas, and bank statements belonging to healthcare workers