Recipients were told they were targeted by a sophisticated hacking attack; agency confirms incident, does not provide details