Booking platform hack exposes third

A cybersecurity breach at accommodation software provider RMS Cloud has left multiple Australian holiday park operators dealing with reputational damage and regulatory questions after scammers used real guest booking data to send phishing messages.

RMS Cloud provides cloud-based property management and booking systems to more than 6,000 hotels, holiday parks, and serviced apartments globally. The company confirmed it is investigating phishing messages sent via WhatsApp, SMS, and email that “reference genuine booking information” and request payment details.

“Our teams are actively investigating the activity and taking steps to contain it, protect customer information and support affected customers and integration partners. No payment card information has been exposed from RMS,” RMS Cloud said.

BIG4, Reflections Holidays, G’day Parks, and Summerstar Tourist Parks are among the operators affected, according to ABC News .

Operators report guest concerns and business impact

A BIG4 spokeswoman said the breach originated from “a third-party platform which is used by some of the parks within our network, as well as a number of other accommodation providers and groups.”

“This has resulted in some guests receiving fraudulent messages asking for credit card or payment details,” she added.

Cherie Midson, who manages a holiday park in Victoria’s East Gippsland, said guests began contacting her business after receiving messages containing accurate names and dates of stay. “The messages started going out last night and the calls started coming in today. Some of the details, like names and dates of stay, are correct,” Midson said.

Midson said she reported the matter to Scamwatch and raised concerns the flow-on effects. “It’s very worrying. Our details are being used, which reflects on us as a business. We’re concerned our guests could fall victim to the scam, and if they do, our business will be associated with that. That’s a real worry for us,” she said.

Reflections Holidays sent text messages to guests warning them not to click links or payment details. Summerstar Tourist Parks issued a similar warning on social media.

The broker question: does the policy respond?

The holiday parks did not suffer a direct breach of their own systems. Yet they face reputational harm, customer remediation costs, and potential notification obligations under the Privacy Act 1988.

Whether a standard cyber policy responds depends on how it defines “computer system.” Some wordings explicitly include third-party networks and cloud platforms. Others leave outsourced infrastructure unclear.

Vicky Sheridan, senior claims specialist for cyber at AXA XL in Australia, said the trend is accelerating. “We’re also seeing growing exposure to cyber risks arising from third-party technology providers,” Sheridan said. She noted that incidents involving shared platforms can “trigger cascading effects” across interdependent organisations.

Earlier in 2026, a single vendor compromise at financial services firm youX created notification obligations for roughly 800 broker firms and more than 90 lenders, demonstrating how quickly a third-party breach can spread across an industry.

The Office of the Australian Information Commissioner (OAIC) recorded 1,205 data breach notifications in 2025, an all-time high and an 8% increase on the prior year. Of those, 716 were attributed to malicious or criminal attacks. The OAIC has noted that multi-party breaches stemming from cloud or software providers represent a growing of notifications.

Hospitality sector faces specific vulnerabilities

Research published by the Council of Small Business Organisations Australia (COSBOA) in February 2026 found that only 47% of hospitality respondents used unique passwords, 37% had cloud-based backups, and roughly one-third had multifactor authentication on their email systems.

Cybersecurity expert Professor Daswin de Silva said travel data was “highly valuable” because it contained detailed information a traveller’s identity.

“There’s an assumption that people who travel have financial capacity, which makes them appealing targets for cybercriminals,” he said.

The Australian Competition and Consumer Commission’s (ACCC) Scamwatch service received more than 13,000 reports of phishing scams in the first three months of 2026.

For brokers advising hospitality and tourism clients, the RMS Cloud breach is a prompt to check whether existing cyber policies cover losses that originate at a third-party vendor and whether clients have adequate vendor risk management clauses in their own supplier contracts.