Only the email addresses were exposed; none of the names or other identifying information of the whistleblowers was revealed