A data breach at 20 US hotels operated by HEI Hotels and Resorts for Starwood, Marriott, Hyatt and Intercontinental may have divulged payment card data from tens of thousands of food, drink and other transactions, HEI has said.