iPhone lost mode - data leak

Hello,

My girlfriend's iPhone was robbed last week and I put it in lost mode with a message and my personal phone number in case someone use it.

I also put a notification if found.

Today, I received a text saying the iPhone has been found with a really strange URL: http://security-icloudid.com

There is no doubt this is phishing, but my question is, how did they got my phone number and how they know I'm looking for this particular iPhone (they sent me the details about it: size, color, model)...

Are our data safe in iCloud? I start wondering...

I'm perfectly sure I didn't put my phone anywhere else except my provider and police.

If someone has a clue.