While what was specifically included in the breach is still unknown, I can tell you when my sister and her family of four made their reservation for the Prague Sheraton six months or so ago the Website did ask for the names and SS#s passport #s for all four guests. It was part of the record and something the Website was set up to capture.

We did not originally add the passport numbers but shortly after making the reservation received an email from the hotel manager indicating those numbers needed to be added or the reservation would be canceled, and if the passports presented at check-in had different numbers there would be an issue.