The travel giant notified customers that their personal data, including names, email addresses, and phone numbers, may have been accessed in a security incident.