Substack says intruder lifted emails, phone numbers in months-old breach