A former third-party lost sensitive data on hundreds of thousands of users and now people are getting phishing emails.