Hackers 'stole 41 million credit and debit card numbers from major retailers' in what is believed to be the biggest case of its kind in the US.