The travel giant notified customers that their personal data, including names, emails, physical addresses, phone numbers may have been accessed in a security incident.