US nonprofit healthcare supplier says hacker stole medical and private information of 1M+ sufferers