The phone number is unlisted, but the point is that it was supposed to be sent over HTTPS and it wasn't.