Tesco Bank says £2.5m was stolen from 9,000 customers in cyber-attack