Phishing Attacks Target Hotels via Compromised Booking Data

Cybercriminals are executing phishing campaigns against the hotel industry, targeting both guests and hotel staff. Guests are receiving deceptive messages that appear to come from their hotels, asking for credit card details under the guise of confirming reservations. Affected IT service provider Seekda has reported unusual access patterns, indicating a possible breach of booking data. The phishing messages are highly credible due to the attackers' access to real booking information, including hotel names and travel dates. Bitdefender has also identified campaigns aimed at hotel staff, impersonating guests and Booking.com notifications to trick employees into clicking malicious links. The attacks are impacting hotels in various countries, including the UK, Italy, and the US. Data protection authorities are issuing warnings, but the full extent of the incidents remains unclear. Seekda is currently investigating the breaches with high priority.

Key Points: • Phishing attacks are targeting hotel guests and staff using real booking data. • Seekda, an IT service provider, is investigating unusual access patterns linked to the attacks. • Bitdefender has identified campaigns impersonating guests and Booking.com to trick hotel employees.