Ten million customers' personal data exposed by booking software glitch