Substack confirms data breach affects users’ email addresses and phone numbers