The HR giant said hackers mounted a socially engineered cyberattack on its third-party CRM system but did not gain access to customer information; only "commonly available" business contact info was exposed.