Up to 339 million people may have been hit in a cyber-attack on a chain later bought by Marriott.