The medical records, payment information and fingerprint scans of at least 1.8 million patients have been stolen in a major data breach.