The personal data of at least 20 million bank and credit card users in South Korea has been leaked, state regulators say, in one of the country’s biggest ever breaches.