More than nine million people may have had their details stolen in the 2018 cyber-attack.