The breach exposed information like names, addresses and phone numbers and lasted more than a month, the company reported in a securities filing.
