Millions of AT&T customers have been notified of a data breach at a third-party vendor