Marks & Spencer confirms customers’ personal data was stolen in hack