Tens of millions of names, phone numbers and other sensitive information were leaked in a breach that went undetected for months.