Email addresses, home addresses, phone numbers and Social Security numbers were exposed in a phishing campaign that fooled about 20 employees.