British sports-fashion retailer JD Sports says that the stored data of 10 million customers "may have been accessed" in a cyberattack, including names, addresses, email addresses, phone numbers, order details, and the final four digits of debit card numbers.