-
A threat actor is offering what they described as 16 million hotel reservation rows, plus a credit card field.
-
There are no names of hotel chains, travel websites, or software companies mentioned in the listing. So it’s unclear who the actual victims are.
-
Genuine booking information makes fraudulent emails appear convincing. Guests should confirm any payment request with the hotel directly.
A seller on an underground forum says it has about 16 million hotel reservation records for sale. The seller says the data comes from a shared dashboard that thousands of hotels use.
Online travel agencies feed bookings into that dashboard. However, no company has admitted a breach. A search of public reports also found no outside confirmation.
Details of the Seller’s Claim
The listing claims that there is customer information, check-in and checkout date, type of room, amount, and travel site ID numbers in the dataset. Also, there is one field named credit_card_details. Furthermore, there are notes about pay-at-hotel options, cancellation, no-shows, and booking changes in the rows.
Notably, most of the reservations originate from the USA, UK, India, Philippines, Australia, Germany, Japan, France, and Italy. The seller adds that new reservations with card data arrive daily. If the claim is true, the seller still has access. The seller will share the source only with buyers.
So far, the claim stands alone. Searches found no public comment from any security firm, hotel group, or travel site. Public reports also show no sample of the data.
The headline number also needs care. The figure of sixteen million rows doesn’t imply sixteen million individuals. For instance, one booking platform data breach in 2020 featured one row covering multiple guests. Likewise, one guest can appear in many rows.
The card field raises another question. No one knows if it includes the whole number, the partial number, or something different. Industry standards of the card business don’t allow for keeping the security code after the approval. Still, a field name alone proves little.
Without a vendor name, hotels cannot check their own exposure. Travel sites face the same problem. Meanwhile, thousands of properties could share one weak point. Keeping the source secret also makes the claim hard to test before anyone pays.
How the Latest Listing Compares with Previously Confirmed Cases
There have been previous cases involving hotel booking data breaches. For instance, in 2020, the scientists from Website Planet came across an open cloud storage bucket of Prestige Software with more than ten million files since 2013 and including credit card numbers and security codes. This data was confirmed to belong to the company by Prestige. There is nothing that connects the two events.
The platform attack has also been observed in the case of famous companies. Otelier, a tool used by more than 10,000 hotels, suffered a leak of about 7.8 terabytes of data. The attack included stealing an employee login with the use of password-stealing software. Both Otelier and Marriott confirmed these findings.
There have been recent cases. For example, in 2025, BWH Hotels reported that hackers managed to hack their reservation system and remained undetected from October 14, 2025, to April 22, 2026. They could access guest names, contact information, and reservations.
The company stated that there was no payment data in this system. Booking.com also confirmed in April that hackers viewed reservation details and contact information. It reported no financial data exposed. In June 2026, Dutch hotels also faced similar security problems, with a data breach exposing guest information across more than 100 properties.
Card Data Raises the Stakes
Booking details alone already fuel scams. One Wired report revealed that criminals hit at least 350 hotels and vacation rentals in 50 countries. They sent fake messages posing as hotel staff and deceived guests using their real booking details.
Victims landed on fake sites that stole card details. In Japan, the reservation system Temairazu recently reported a breach followed by the same kind of scam. The company said it does not store card data.
A Cloudbeds executive told Wired why this works. The attackers saw exactly who was staying, when they’d arrive, and what they paid. Card data adds another path. Criminals can try online purchases without the physical card. Underground sellers already offer hotel stays at about 35 percent of retail price, according to fraud firm Seon.
What’s Next for Everyone
While the data leak and the exact hotels or booking services involved remain unconfirmed, guests and hotels can still take proactive steps to secure their data.
To begin with, do not trust any payment requests, even if the dates and prices correspond. Don’t click the link. It’s safer to book using the official hotel app, if they have one, or call the number indicated on their website.
And don’t ignore card alerts; set them up, and keep a close eye on your account statements. That way, you’ll catch odd charges faster. Think you made a payment by clicking on a suspicious link? Contact your bank right away, block the card, and request a replacement.
Hotels and travel agencies could also change their passwords and watch for changes to bank transfer details and admin rights. Other properties can copy that step now. In addition, they can turn on two-step login and limit who can export guest lists. They can also delete card data they no longer need.
You’ll know for sure if you spot a data sample, a statement from the vendor, or a hotel breach notice. Until one appears, the listing remains a claim. In the end, staying safe doesn’t involve too many complex steps.
If guests double-check every payment request using official channels, it costs them almost nothing and keeps their info secure.
