In an email sent to shoppers Thursday morning, the company said the breached records may include the names, addresses, emails and phone numbers of customers — though no passwords, credit card details or similar confidential data were involved in the incident.