The attackers allegedly earned almost $11 million by using the stolen information to sell mobile phones.