CeX, a U.K.-based retailer of second hand goods, says up to two million of its online customers have had their data stolen in a security breach.