Hotel titan Marriott announced Friday that no more than 388 million customer records were stolen during a nearly four-year long hack that the company first announced in November 2018, CyberScoop reports. That’s significantly lower than the company’s original estimate of 500 million, and the company claims the true number is likely even less. As it stands, the hack remains one of the largest-ever recorded breaches. Hackers also reportedly stole 25.5 million passport numbers, 5.25 million of which were stored in plain text, and 8.6 million encrypted payment cards. The hack is currently under investigation in at least five states, CyberScoop notes, and is also being probed by European regulators. “We deeply regret this incident happened,” Arne Sorenson, Marriott’s president and chief executive officer, said in a statement when the hack was first announced last November.  “We fell short of what our guests deserve and what we expect of ourselves. We are doing everything we can to support our guests, and using lessons learned to be better moving forward.”