Twilio, the developer of the Authy authenticator app, said user phone numbers were leaked to attackers, but accounts themselves were not compromised.