Hackers could have scored unlimited airline miles