Personal details of up to 2.4 million Carphone Warehouse customers may have been accessed in a cyber-attack, the retailer says.