Marriott admits it falsely claimed for five years it was using encryption during 2018 breach