A company has been fined £14m for failing to keep data safe during a cyber attack, which resulted in more than six million people having their data stolen.