Millions of cruise passengers may have had their personal information exposed in a major cyberattack targeting the world's largest cruise operator.