Millions of people could have had their credit card and bank details stolen after a “significant and sustained cyber attack” on TalkTalk’s website.