Attackers also gained access to 1.2 million records containing personal details in one of the UK's biggest data breaches.