The details of 9m customers have been compromised, including about 2,000 credit card numbers, in a major data breach