Securityaffairs.Co BWH Hotels Data Breach Exposes Guest Reservation Information for Six Months
Article Content
- •BWH Hotels confirmed a data breach affecting guest reservation data for over six months.
- •Unauthorized access included names, email addresses, phone numbers, and reservation details.
- •No payment information was compromised; guests are advised to be cautious of phishing attempts.
BWH Hotels has confirmed a data breach affecting guest reservation data across its brands, including WorldHotels and Best Western. The breach, which lasted over six months, allowed unauthorized access to names, email addresses, phone numbers, and reservation details. The intrusion was detected on April 22, 2026, but the compromised data dates back to October 14, 2025. BWH Hotels has stated that no payment information was involved in the breach. The company has engaged cybersecurity experts to enhance security measures and has advised guests to be vigilant against phishing attempts. The exact number of affected guests remains undisclosed, and BWH Hotels is investigating the incident further. The breach follows earlier reports of customer booking data being misused in phishing campaigns.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (3)
Following this threat?
Track BWH Hotels in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
Critical SQL Injection Zero-Day in Arista VeloCloud Orchestrator Exploited Arista Networks has patched a critical zero-day vulnerability (CVE-2026-114625) in its VeloCloud Orchestrator (VCO) that is actively being exploited. The flaw allows authenticated users, even those with basic privileges, to escalate their access to superuser status via a low-complexity SQL injection attack. This…