M&S says customer data stolen in cyber attack