The huge Marriott hack compromised more than five million unencrypted passport numbers, the hotel giant said.
The FBI is leading the investigation into the data theft, which officials say points to hackers possibly working for China’s secret service.
In addition to the 5.25 million unencrypted passports, about 20 million encrypted passport numbers were accessed.
Unencrypted passport numbers allow intelligence agencies to scan personal travel and financial history, which could be used for espionage.
"You can identify things in their past that maybe they don’t want known, points of weakness, blackmail, that type of thing," said Priscilla Moriuchi, an analyst with Recorded Future who previously worked at the NSA.
Marriott now says data from about 383 million guests was compromised, less than the estimated 500 million first feared.
It said approximately 8.6 million encrypted payment cards were accessed but says there is no evidence any fraud was carried out by a third party.
The company also ticked off another post-merger milestone with the phasing out of the Satrwood reservations database at the end of 2018.
All reservations functions are now via the Marriott system.
