The breach is the one of the largest ever reported and is under investigation by at least five U.S. states as well as European regulators.