Hackers have stolen tens of thousands of personal ID photos from a messaging app popular with children after hijacking a system used for online safety age checks.