Substack said a security breach discovered this week allowed an intruder to access users’ email addresses, phone numbers, and internal metadata in October