CGI Group head says company had identified unspecified Eastern European actor as behind breach that affected 4 or 5 phones; claims Blue and White sought info on political rivals