Marriott says database hacked, 500 million guests could be at risk