Marriott's data breach hits fewer records than predicted, but brand is bruised