More than 1.1 million debit and credit card records were stolen from former Thomas Cook subsidiary Essential Travel.