Twitter says spear-phishing attack on employees led to breach