Hotel Booking Data Breach Reports: What Travellers Need to Know
Guests have reported WhatsApp messages that quote real details about their accommodation bookings and ask them to “verify” a reservation or pay. Here is what has been reported, what is still unconfirmed, and how to check a message before you respond.
- A message can know your real booking details and still be fake. Name, dates and price are not proof of who sent it.
- Never use the link or number inside the message. Open your booking app or our website yourself.
- Already paid or shared card details? Call your bank now using the number on your card.
In late September and early October 2026, accommodation hosts began sharing reports of guests receiving WhatsApp messages that referred to genuine reservations. Reported details included guest names, stay dates, accommodation names, booking amounts and part of a reservation reference.
How a stranger obtained those details has not been established in the information available to us. The reports deserve to be taken seriously, but the cause and scope should not be treated as confirmed.
What we know, and what we don’t
Reported
- Guests have received WhatsApp messages quoting real or apparently accurate booking details.
- Some messages asked guests to verify a reservation or payment through a link.
- Hosts have shared reports involving bookings made through different channels.
- A hospitality technology provider privately notified its host customers of a possible data compromise and an investigation.
Not yet confirmed
- How or through which system the information was obtained.
- How many guests, bookings or businesses are involved.
- Whether all reported messages come from one source.
- Whether any particular booking platform or provider was the point of access.
Reports shared with hosts are not a completed public investigation and do not mean every guest or booking was affected.
Anatomy of a fake booking message
Messages like this work because the details feel right. Here is what to look for.
- 1Real details. Your name and dates may be correct. That proves nothing about the sender.
- 2Time pressure. “Within 2 hours” or “avoid cancellation” is designed to stop you checking.
- 3Unknown number. Not listed on the accommodation’s official website or your confirmation.
- 4Outside link. Payment requested on a website that isn’t your booking platform.
What to do if you receive one
- Step 1 · Stop
Don’t click or pay
Knowing your booking details doesn’t make the sender genuine. Don’t reply with personal or card information.
- Step 2 · Verify
Check it yourself
Open your booking app or the accommodation’s official website directly and contact them through the details listed there.
- Step 3 · Report
Keep and report it
Screenshot the message, report it to the booking platform, and to Report Fraud.
Already entered card details or paid?
- Contact your bank straight away through its app or the number on the back of your card.
- Never share one-time passcodes or security codes, even if the caller says they are from your bank or the property.
- Report it to Report Fraud and to your booking platform.
Genuine message or scam?
A genuine Sidemersey message
- Comes from a number listed on our Contact Us page, or through your booking platform’s own inbox
- Never asks you to pay through a link sent on WhatsApp
- Is happy for you to hang up and call us back on a listed number
Warning signs
- Unfamiliar number or new account
- Deadline or threat of cancellation
- Payment link outside your booking platform
- Requests for card details or codes
Why a booking can pass through several systems
A reservation made on one website is often processed by other connected software too. Each accommodation business uses a different combination.
- You book
- Booking platform or direct site
- Channel manager
- Property management system
- Accommodation provider
This helps explain how booking information is distributed, but it does not show where the September reports originated or that any named platform was breached. Earlier 2026 reporting on reservation phishing, such as WIRED’s May 2026 coverage, is useful background on the technique but describes separate incidents.
What Sidemersey Livings has done
Published our official numbers
Our Contact Us page lists every number we use: main line, management, reservations, operations/WhatsApp and staff.
Warned upcoming guests
We sent a warning through the platform each guest booked on, so it sits in the message thread linked to their reservation.
Following official guidance
We are handling this developing matter in line with applicable rules and government guidance.
Published this page
We will keep it updated as verified information becomes available.
Got a message about a Sidemersey booking?
Check the sender against our official list. If the number isn’t there, or the request feels unusual, don’t reply with any personal or card information. Contact us on a listed number and we’ll confirm whether it came from us.
We only phone or WhatsApp guests from numbers published on that page, or message you through your booking platform.
Common questions
Was my booking with Sidemersey Livings affected?
The source and scope of the reported messages are not confirmed. We have warned upcoming guests through their booking platform. If you receive anything unexpected about your stay, check it against our official numbers before responding.
The message knew my name, dates and price. Isn’t that proof it’s real?
No. Scammers can hold accurate booking details. The only reliable check is to contact the business using a route you choose yourself, such as its official website or your booking app.
Will Sidemersey ever ask me to pay through a WhatsApp link?
No. Payments are handled through your booking platform or as described on our payments page. If a request looks different from your booking terms, contact us on a listed number first.
Where should I report a suspicious message?
Report it to the platform you booked through and to Report Fraud, the UK’s fraud and cyber crime reporting service. You can forward scam texts to 7726 free of charge.
Update log
- Page published with traveller guidance, a known/unconfirmed summary, Sidemersey’s guest-protection actions and contact verification.
- Next updateNew developments will be added here with their date and source status.
