The hotel chain says details of up to 500 million guests may have been accessed in a database breach.