Would it be premature to change my account password in response to this? Also, does anyone know if phone numbers associated with accounts are included in this breach?