Dish has told employees that it’s “investigating a cybersecurity incident” and that it’s “aware that certain data was extracted” from its IT systems as a result of this incident, according to an internal email sent by CEO Erik Carlson and obtained by The Verge. This comes on the fifth day of an internal outage that’s taken down some of the company’s internal networks, customer support systems, and websites such as boostinfinite.com and dish.com.

The email doesn’t contain any details about whether the data was Dish internal information or customer data, though it does say that “it’s possible the investigation will reveal that the extracted data includes personal information.” The extent of the leak may not be fully known yet, as the email, sent on Tuesday morning, says the company’s “working around the clock to understand the issue and restore affected systems as quickly as possible” and that it has “limited information at this time.”

Dish hasn’t publicly shared much information about the incident since Friday afternoon, when Carlson mentioned it on an earnings call, and it has not responded to multiple requests for comment from The Verge. MarketWatch reported Tuesday morning that Dish had confirmed the cyberattack via a securities filing. The filing notes that the company only learned about the data exfiltration on Monday and that it’s working with “third-party experts and advisors.”

The outage has had an impact on both customers and employees alike. Dish subscribers, as well as Boost Infinite and Boost Mobile users, haven’t been able to contact customer support to do things like activate new equipment, cancel their service, or even make a payment in some instances. Dish currently has a skeleton version of its main website that directs users looking for support to an FAQ page and some basic troubleshooting steps.

One Dish employee told The Verge that management expects them to work overtime to clear through the support backlog when the systems come back online. They also said that teams have to be on standby, as they’re expected to start taking calls within an hour of the systems being restored. “I’ll be honest, I’m not looking forward to it,” they said.

Several employees have told The Verge that they’re being paid during the outage despite not being able to work, though that’s not necessarily the case for everyone. One source who works for a regional service provider contracted to install Dish systems said that management was “trying to find a way to pay us for this unpaid time off” but that it wasn’t a sure thing. “I hope Dish does something about that, because many of us are paycheck to paycheck and can’t afford this time off,” they said.

Some employees have noted that the company has been slow to share updates and information, even internally. “I wish they’d give more light on the situation,” said one person, while another said that their manager’s method of communicating with one-line daily updates was “so bizarre.” (Some Dish workers are unable to access their emails due to the VPN being down and are relying on communication from site management.) The latter employee said the first definitive thing they’d heard about a cyberattack was when I asked them about Carlson’s email and they found a story by CNBC.

There currently doesn’t appear to be any ETA on when Dish’s systems will be back up and running, either from the company itself or in internal communications. Some employees report being given estimates, but they don’t appear to be based on official company policy.