Debit-card data stolen in breach of retailer