Science & Tech · Cybersecurity · 5 hrs ago
RMS data breach prompts convincing booking scams across Australia
Hackers accessed customer information held by booking provider RMS in a data breach affecting people across Australia.
The exposed information included names, accommodation booking details and contact details, but RMS said payment and credit card details were not involved in the breach.
Scammers used real booking details to send convincing messages to travellers, including people with stays planned in Broome, Western Australia.
Some messages asked recipients to enter card details through a link or risk losing their booking.
The breach has prompted warnings for travellers not to click links or pay in response to unexpected messages about a reservation.
RMS said the unauthorised activity had been contained and investigations were continuing to assess the incident’s full scope and impact.
Accommodation providers may need to contact affected customers and help them respond to the scams.
Hackers accessed names, booking information and contact details in a breach involving third-party booking provider RMS.
Customers across Australia have received phishing messages that used accurate details about their accommodation bookings.
Some messages asked customers to provide payment details through a link or risk losing their booking.
RMS said the unauthorised activity had been contained and investigations were continuing.
A cybersecurity expert warned that more accommodation providers and customers could be affected.
- Who
- Hackers accessed data held in the RMS environment; customers and accommodation providers across Australia have been affected.
- What
- A data breach was followed by convincing phishing messages targeting people with accommodation bookings.
- When
- The messages were reported after the breach; one traveller received a message last week. RMS said the unauthorised activity was contained yesterday.
- Where
- Across Australia, including Broome and other parts of Western Australia's Kimberley.
- Why
- The messages used genuine booking details to make requests for payment or card information seem credible.
This story does not have two clearly opposing sides.
Hackers accessed names, booking information and contact details from the RMS environment.
Cameron Craig received a WhatsApp phishing message about his upcoming booking at Cable Beach Club in Broome.
RMS said it had contained the unauthorised activity in its environment.
- Provider
- RMS, a third-party booking provider
- Data accessed
- Names, booking information and contact details
- Broome booking
- Cable Beach Club
- Reported scam channel
What people are saying
increasingly sophisticated
weaponise urgency, fear and authority and trust
This is just the tip of the iceberg.
Our advice to guests is not to respond to unexpected messages, click links, provide card details or make payments in response to communications about their booking.