My assumption is a bunch of "less critical" info on ~8m pasengers was accessed (phone numbers? names?), and then ~1m had passport or credit card numbers leaked

My assumption is a bunch of "less critical" info on ~8m pasengers was accessed (phone numbers? names?), and then ~1m had passport or credit card numbers leaked, and they itemised the "more important" ones explicitly. It doesn't make a lot of sense however I parse it, but that's the only thing that makes the numbers work.