At least four million New York residents may have been impacted by a medical company’s data breach that could potentially lead to identity theft, the state attorney general said.