Customer data from more than 350 hotels around the world may have been accessed as part of realistic reservation-hijacking scams.