Target data breach may affect 40 million customers