The sportswear giant says criminals accessed its systems through a “third-party customer service provider.”