Kayak acknowledges that a third party — it turns out to be one of its hotel customers — was able to match a last name on the site with the last four digits of people’s credit cards, and that others could have done so, too.