I will advice every stake user to activate 2fa on their account, it's for their security, even if you are phished, with 2fa active, it will be difficult for the hackers to withdraw the funds on your account or make any meaningful changes to your account's security and privacy settings.
Stake.com claim all data is safe even though hackers claim to have stolen more than 400,000 user data however this statement cannot be confirmed. The admin at stakecommunity.com suggests users who have already clicked on the link to change the password and set up 2FA just for anticipation, so if any user still get phishing email then it's possible they have clicked on the link and their email has been recorded so the best way is to change the emai.