The company says up to two million customers are affected by the data breach.