Hackers were able to steal customer data from Saks and Lord & Taylor for a year, potentially stealing five million credit and debit cards.