The personal data of M&S customers has been stolen by hackers during a huge cyber attack that may have cost the company millions.