Hotels Across Australia Impacted by Phishing Scam Following Booking Provider Data Breach

A data breach involving third-party booking provider RMS has affected multiple hotels across Tasmania and Australia, leading to sophisticated phishing scams targeting guests with accurate reservation details.

Reported on October 29, 2026, the incident involves guest names, contact information, and booking data being compromised. According to RMS, the stolen information has been utilized by bad actors to send convincing messages via email, text, and WhatsApp.

Details of the Phishing Scam

Guests at properties such as Wrest Point Casino in Hobart have reported receiving messages featuring genuine reservation summaries, including actual booking numbers, room types, and correct check-in and check-out dates. The fraudulent messages claim that the credit card used for the booking has been blocked by the issuing bank and urge recipients to click a link to update and verify their payment details to prevent reservation cancellation.

RMS Chief Executive Adam Seskis issued an apology, noting that scams are becoming increasingly sophisticated. However, he confirmed that credit card and other payment details were not accessed during the initial hack.

Affected Properties and Providers

The RMS booking management system is utilized by more than 6,000 hotels, holiday parks, and serviced apartments globally. In Australia, affected providers include:

• Federal Group, which operates Wrest Point Casino and Country Club in Tasmania
• ALH Hotels, operators of Nightcap and Nightelier accommodation
• Discovery Parks, including its resort at Cradle Mountain
• Interstate holiday park operators such as BIG4, Reflections, and G'day Parks

Expert Advice and Verification

Experts and company officials have outlined practical steps for anyone who receives suspicious communications:

• Do not click links: Delete suspicious messages immediately and do not forward them.
• Secure devices: If a link was clicked, run antivirus software and change compromised passwords.
• Contact financial institutions: Anyone who inadvertently shared payment details should contact their bank immediately.
• Verify independently: Affected providers, including Wrest Point, have been emailing guests to detail how genuine contact is made. Travellers can verify alerts by contacting accommodation providers directly through official published phone numbers or websites.

University of Tasmania Adjunct Professor and cybersecurity expert Joel Scanlan stated that while third-party systems are common targets for hackers due to the aggregation of data, they often possess greater security resources than individual hotels could afford independently. He noted that such incidents highlight the importance of knowing what personal data is exposed and remaining vigilant against targeted phishing attempts.