Attackers steal password data, user messages, email addresses, and more