NHS confirms patient data stolen in cyber attack