Orbitz says hacker stole two years' worth of customer data