Phishing waves: Cyberattacks on IT service providers for hotels

In the middle of the holiday season, successful attacks on IT service providers in the hotel industry are increasing. Guests are currently receiving increasingly deceptive-looking phishing messages that urge them to make payments or reveal credit card details. Because the criminals can access real booking data, the fraud attempts are hardly distinguishable from genuine hotel communication. Several providers are affected; data protection authorities and industry associations are now issuing explicit warnings.

One of the current cases concerns the Austrian IT service provider Seekda. Following a phishing attack, Seekda is informing its hotel customers unusual access patterns to its systems. The exact extent of the security incident is not yet fully clear. Seekda offers hotels software for managing bookings, sales channels, and other hotel processes.

As a result of the IT security incident, guests of various hotels are receiving deceptive messages from different criminal accounts. Seekda stated in an automated confirmation of receipt that its team is currently only processing affected cases. Due to an “exceptionally high volume of tickets”, processing times are significantly extended.

An affected hotel customer from Italy contacted her hotel after receiving a WhatsApp request to confirm her booking within twelve hours, even though the stay was already fully paid. For the supposed confirmation, she was asked to re-enter credit card details, including the CVV code, via a link.

It is striking that the perpetrators not only know the name of the booked hotel but also the correct arrival and departure dates. In one case, an affected person was asked to confirm the reservation via a supposedly secure website. Otherwise, the booking would be canceled.

The attackers are using domains that suggest a connection to hotel reservations, such as bookcheckarrival-gueststayhotel.com. In another message, a guest at a hotel in Valencia is urged to complete a “routine confirmation step”. Here too, the perpetrators threaten an automatic adjustment of the booking status if confirmation is not received.

The fact that the perpetrators apparently know individual travel data significantly increases the credibility of the fraud attempts. It is not yet clear whether the criminals could access booking or data from the systems of affected hotels and what data they possess in detail.

The service provider informed affected hotels that the incident is being investigated with “highest priority”. It is currently unclear how many hotels are specifically affected. It is also unclear when and how the attackers gained access to potential booking and data. It is also unknown exactly which data is affected and how many guests the criminals have already contacted.

At the same time, the Hotel and Restaurant Association DEHOGA Nordrhein is also warning increased phishing and fraud attempts against hotel guests. According to the association, affected individuals are currently receiving deceptive messages via WhatsApp, SMS, or email. They are asked to make short-term payments, enter payment or credit card details, or confirm a booking via a link. In some cases, the perpetrators threaten cancellation. It is particularly problematic that the messages sometimes contain correct booking data such as names, hotel, travel period, or reservation details.

The association cites various attack scenarios as possible causes. These include compromised accounts of individual accommodations, security incidents at Booking.com, and possible compromises of third-party systems. These include property management systems, channel managers, CRM systems, and other software that processes booking data.

Another security incident in the industry was reported at the hotel software provider ibelsa. The company explained that on July 25, 2026, there was unauthorized access to its systems. According to the investigation at the time, personal data of hotel business partners and their guests had been leaked. However, according to ibelsa, payment data was not affected.

ibelsa explicitly warned that the obtained data could be used for fraudulent attempts referring to actual bookings. The company also stated that it had reported the incident to the Independent Data Protection Center of Saarland and filed a criminal complaint with the Saarland police.

As early as June 2025, a series of phishing incidents involving Booking.com and hotels in South Tyrol became public . Guests received messages that gave the impression they were from their accommodation or from the Booking.com environment. The causes of the incidents could not be clearly attributed at the time.

Affected parties and service providers examined, among other things, compromised Booking.com accesses, possible data queries, and systems of technical partners. A central unauthorized access to a collective account could be ruled out at the time. However, it remained unclear where the attackers obtained the guest addresses and booking information used in individual cases. Booking.com also stated at the time that individual accommodation partners had been compromised by convincing phishing emails; as a result, criminals had gained partial access to the accommodations' accounts and could pose as hotels to guests. In April 2026, Booking.com then admitted unauthorized third-party access to booking information and informed affected customers with new security PINs.

The current cases thus show once again that the entire digital processing chain of the hotel industry is of interest to criminals – from booking platforms to interfaces and hotel software to individual hotel accounts. Not every phishing incident can be immediately and unequivocally attributed to a specific cause, a compromised access, or an individual service provider. However, other industries are also affected. For example, the CCC pointed out security vulnerabilities on the websites of over 500 restaurants at the beginning of 2025. Similar phishing waves previously affected Best Western Hotels as well as other tourist booking systems worldwide .

Guests should always critically examine requests to re-enter payment or credit card details, especially if the booking has already been paid or the is made via a previously unused channel such as WhatsApp. Scammers also use the same method on Booking, PayPal, and other platforms : they send deceptive messages with real customer data to obtain payment information. They should not open links from unexpected messages and should not enter credit card, CVV, or other payment details into forms accessible via such links. Instead, they should the hotel exclusively via a known phone number or the official website – not via details from the message.

Anyone who has already entered card details should immediately the issuing bank, have the card blocked if necessary, and check the transactions. Affected individuals should secure suspicious messages, screenshots, and sender addresses and phone numbers.

The State Commissioner for Data Protection and Freedom of Information Mecklenburg-Western Pomerania , Sebastian Schmidt, also warns of phishing following a cyberattack on a provider of hotel databases. According to the authority, data breach notifications have recently been received increasingly from hotels that use a nationwide booking database. According to the knowledge there, complete hotel databases were leaked, including names, addresses, and other booking-relevant information of guests. Initial phishing attempts with this data are already known.

According to Schmidt, guests should never transfer money based on a message whose authenticity they cannot unequivocally verify. As a rule, the hotel already has all the necessary data after booking. Those who have already passed on data to third parties can their bank or the police, among others.

Hotels, as data controllers, must also report the incident to the responsible supervisory authority and inform affected guests. The data protection authority also recommends that businesses change all passwords for user accounts related to the affected database, check connected systems and logs for unusual access, check backups, set up two-factor authentication, and sensitize employees to phishing.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.