Social media firm also links IP addresses in Malaysia to software bug allowing phone numbers to be accessed without permission