Without more detail, it sounds like the database that stores reservation details were hacked. As such, it is not necessarily all SPG account details, but rather the details that are stored/copied with each reservation. It sounds like a lot of the details were copied into the reservation (e.g., address, etc), but account information that has no need to be attached to an individual reservation (e.g., lifetime nights, points, promotion participation history, etc) are unlikely to be compromised.