Data belonging to tens of thousands of patients stolen in cyberattack targeting external hospital service provider