Hackers hit a third-party contractor’s IT systems, but they didn’t steal any addresses or financial details, officials say.