Loading story…
BWH Hotels confirmed a cyberattack after detecting unauthorized access on April 22 that exposed customer reservation information stored in a web application. The compromised data included guests' names, email addresses, phone numbers, postal addresses, reservation numbers, stay dates, and special requests, with records generated between October 14, 2025 and April 22, 2026 potentially affected. The company said payment card and bank account information were not impacted.
BWH Hotels said it took the affected application offline, revoked the unauthorized access, and brought in external cybersecurity experts to investigate and strengthen defenses. The company also warned customers to watch for phishing and other suspicious communications—including emails, texts, WhatsApp messages, or phone calls—that reference hotel reservations or stays and could use the stolen personal details to appear legitimate.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
In May 2026, BWH Hotels publicly confirmed the cyberattack and warned customers that reservation and personal information may have been exposed. The disclosure stated that the affected data set covered records generated between October 14, 2025, and April 22, 2026.
Following detection of the intrusion, BWH Hotels took the affected application offline, revoked unauthorized access, and engaged external cybersecurity experts to investigate and strengthen safeguards. The company also began advising customers to watch for phishing and other suspicious communications referencing hotel reservations.
On April 22, 2026, BWH Hotels detected unauthorized access affecting a web application that stored guest reservation information. The incident exposed customer data including names, email addresses, phone numbers, postal addresses, reservation details, stay dates, and special requests, but not payment card or bank information.
BWH Hotels said the customer reservation data later exposed in the breach was generated starting on October 14, 2025. This marks the beginning of the known data range stored in the compromised web application.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcescworld.com
Open sourcetechradar.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Booking.com warned customers that unauthorized parties accessed personal information linked to some reservations, exposing data that may include booking details, names, email addresses, physical addresses, phone numbers, and information shared with accommodations. The company said it detected suspicious activity, contained the incident, changed reservation PINs, and notified affected guests, while stating that payment or other financial information was not accessed from its systems. Booking.com did not disclose how many customers were affected. The breach was disclosed amid broader fraud and cybercrime pressure on the travel platform, including phishing and impersonation scams targeting Booking.com users. Reporting also highlighted rising consumer complaints and scam losses tied to travel-booking fraud, as well as scrutiny from an earlier Booking.com incident in which phishing against hotel staff exposed data from more than 4,000 people and later resulted in a **€475,000** regulatory fine after delayed breach reporting in the Netherlands.
Jun 29, 2026
Basic-Fit disclosed a breach affecting about **200,000 customers in the Netherlands** after unauthorized access allowed attackers to download personal data before the intrusion was stopped. The exposed information included membership details, names, addresses, email addresses, phone numbers, dates of birth, and **bank account details**. The company said it notified affected customers and reported the incident to the Dutch Data Protection Authority, while media reports indicated the wider impact may extend beyond the Dutch customer base and raised questions about controls that failed to prevent large-scale data exfiltration. Booking.com also warned customers that unauthorized third parties may have accessed reservation-related information after suspicious activity was detected on a number of bookings. The potentially exposed data included customer names, email addresses, phone numbers, and other booking details submitted during the reservation process. Booking.com said the full scope of the incident remains under investigation, reset PIN codes tied to affected reservations, and urged customers to watch for suspicious activity and phishing attempts leveraging the stolen information.
Jun 29, 2026
Marriott disclosed that attackers had compromised the Starwood guest reservation database, exposing records tied to hundreds of millions of guests who stayed at Starwood properties on or before Sept. 10. The company initially said the incident could affect up to 500 million guests, later revising the figure to fewer than 383 million, while stating that at least 327 million records contained personal data such as names, mailing addresses, phone numbers, email addresses, passport numbers, birth dates, gender, and in some cases encrypted payment card details. The breach prompted law-enforcement notification and regulatory scrutiny, including an investigation announced by New York's attorney general. MGM Resorts separately faced repeated fallout from cyber incidents affecting hotel guests. Guest details for 10.6 million MGM customers were later found posted on a hacking forum, and in a subsequent cyberattack the company said intruders stole customer information including Social Security numbers and passport data while disrupting reservations, casino gaming, digital room keys, websites, and mobile apps across most properties. MGM estimated the September attack would cut results by about **$100 million** and add roughly **$10 million** in response costs, with reporting attributing the intrusion to social-engineering tactics linked to **Scattered Spider** and **ALPHV/BlackCat**.
Jun 29, 2026