‘Anybody who has made a hotel booking with these major hotel reservation platforms since 2013 is potentially at risk,’ says digital privacy expert