Customer data stolen in cyber attack, M&S confirms