The 8-month data breach compromised payment data from hundreds of thousands of customers, who booked hotels between August 2016 and March 2017. A non-authorized party gained access to private, financial information from customers, who made hotel reservations; their payment card information was compromised, including: full name, card and account number, card expiration date, card verification code, email, phone number, address and other private identifiable information.