Breaches and incidents
Hotels, campsites and holiday rentals in Mecklenburg-Vorpommern: guest data stolen via booking portals and mailboxes
The state data protection commissioner (LfDI MV) said on 21 Sep it has received unusually many breach reports in recent weeks.
- Disclosed
- Verification
- Checked against a primary source
What happened
- The state data protection commissioner (LfDI MV) said on 21 Sep it has received unusually many breach reports in recent weeks: criminals stole guest master and booking data from booking portals and email accounts of hotels, campsites and holiday apartments, in some cases also bank and payment data; guests then receive convincing scam messages containing correct stay details. The LfDI had first warned on 29 Jul 2026; the 21 Sep notice reports that new cases kept arriving after the holidays.
- Root cause: compromised booking portal and email accounts of the accommodation businesses (method of compromise not detailed).
- No attacker named.
- The LfDI urges businesses to notify guests as quickly as possible and guests not to click links in suspicious messages; no count of businesses was given.