The phone numbers of around 1,900 Signal users were potentially revealed following a phishing attack at Twilio.