Loading story…
National CERT teams in Croatia and Slovenia warned that attackers are using stolen accommodation reservation data to run highly convincing phishing campaigns impersonating Booking.com and lodging providers. The messages, often sent from foreign phone numbers over WhatsApp and sometimes via Viber or SMS, cite real guest names, phone numbers, stay dates, and booking details to claim there is a payment problem or reservation issue, then direct victims to fraudulent websites designed to capture bank card information or induce unauthorized payments.
The warnings follow confirmed security incidents involving Booking.com and the Croatian hotel reservation provider Phobs, whose systems exposed personal, contact, and reservation data used by accommodation providers across the region. Booking.com said unauthorized parties accessed some users’ reservation information but not home addresses or payment card numbers, while SI-CERT said there is no indication financial data was stolen from Phobs; however, both incidents created enough context for realistic social engineering. CERT authorities urged travelers to verify any payment request only through Booking.com’s official app or website or by contacting the accommodation provider through an independent channel, and advised anyone who submitted card data to notify their bank immediately and report financial theft to police.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CERT and SI-CERT warned that stolen reservation details were being used in phishing campaigns impersonating Booking.com or accommodation providers. The scams commonly used WhatsApp, and sometimes Viber or SMS, to reference real bookings and lure victims to fraudulent payment pages to steal card data or induce payments.
SI-CERT reported a security incident affecting Croatian reservation system provider Phobs, used by many accommodation providers in Slovenia and the wider region. Exposed data reportedly included guests’ personal and contact information and reservation details, with no current indication that payment card data was stolen.
Booking.com confirmed that unauthorized third parties accessed reservation information for some users. The company said attackers obtained personal data and booking details, but not home addresses or credit card numbers, and it took containment steps including changing PINs for compromised reservations and notifying affected users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cert.hr
Open sourcecert.si
Open sourcecert.hr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Finland’s National Cyber Security Centre warned that phishing campaigns targeting hotel reservations are abusing **Booking.com** and related accommodation services with messages that look legitimate because they contain real booking details. Victims have received messages shortly after making reservations, sometimes through **Booking.com’s own messaging channel** and sometimes via **WhatsApp**, with references to genuine hotel names, customer identities, and actual reservation information. The messages often begin as routine confirmations before claiming there is a problem with the booking, identity verification, or payment card. The fraudulent messages direct travelers to spoofed websites designed to mimic hotel or booking pages and steal payment-card data. Finnish authorities said the accuracy of the information strongly suggests attackers obtained access to hotel or reservation accounts, likely through phishing or other account compromise, allowing them to view reservation records and in some cases prior conversation history. Officials said similar incidents have been reported for years, with a notable rise in reported cases, and advised customers to verify any payment or identity requests through independent contact channels with the hotel or booking provider.
Jun 29, 2026Gen Threat Labs reported that **more than 350 accommodations in 50 countries** were tied to "Reservation Hijack" scams that used real booking details to target travelers with convincing phishing messages. The campaigns delivered fraudulent payment requests through **SMS, WhatsApp, email, and in-app messages**, directing victims to fake accommodation-branded payment pages. Researchers said the activity appeared organized and repeatable, citing shared phishing-page components, repeated asset paths, fake live-support chat features, and common card-validation language across multiple incidents. The findings followed **Booking.com** warnings to customers that unauthorized parties may have accessed reservation-linked information and reset reservation PINs, indicating exposure of private booking data that could be used to personalize scams. Gen said the largest concentration of affected properties was in Europe—especially **Germany, France, the United Kingdom, Italy, and Spain**—but the activity also reached the **United States** and other regions. The company urged travelers to verify payment requests only through official booking channels, while accommodations were advised to strengthen **MFA**, account monitoring, endpoint protection, and staff phishing awareness.
Jun 29, 2026
Attackers are exploiting hotel reservation systems and booking workflows in a fraud campaign dubbed the **Reservation Hijack Scam**, using stolen reservation details and compromised staff accounts to contact real travelers through trusted channels including Booking.com messaging, email, SMS, and WhatsApp. Researchers said the scam is especially effective because messages arrive in legitimate conversation threads or from authentic hotel accounts, making fake payment requests appear to be routine customer service. Victims are then directed to spoofed guest portals, branded PDFs, or typo-squatted payment sites designed to steal card details or induce bank transfers. In more advanced intrusions, attackers first phish hotel employees for credentials to hospitality platforms such as **Cloudbeds**, or gain persistent access by tricking partners into running malicious commands that deploy a remote access trojan. Cloudbeds said observed cases were caused by credential phishing rather than a breach of its platform. The activity has been reported most heavily in the **UK, France, Germany, the US, Brazil, and Australia**, prompting recommendations that travelers verify payment requests only through official hotel or booking channels, while hospitality organizations strengthen phishing-resistant authentication, access controls, monitoring, and incident response.
Jun 29, 2026