Hackers got into Bookeasy, a Gold Coast company that runs the booking systems behind national park campgrounds in several Australian states. The breach has now reached the Australian Capital Territory. The ACT government has switched off the platform. It says its VisitCanberra service, which handles accommodation and attraction bookings, was also compromised, and it has emailed about 6,000 users to warn them about scams. Bookeasy has confirmed "unauthorised activity" on its platform and says it has brought in outside cyber experts. Its own status update says customers' names, addresses, email addresses, phone numbers and booking details "has or may have been accessed". The company says it has found no access to credit card details. The ACT is the latest government hit, after Queensland, Victoria and South Australia earlier in the week.
What Happened
Bookeasy processes camping and vehicle access permits and other bookings for government parks agencies and tourism operators. The company's website says it has more than 20 years in tourism technology and handles more than 20 million bookings a year, according to the Sydney Morning Herald.
The incident became public in stages:
- 11 November: Parks Victoria put up a notice about "suspicious WhatsApp messages" linked to a booking system issue. It then took its booking system offline. Existing bookings stay valid, but they cannot be changed or cancelled for now.
- 11 to 12 November: Queensland Parks and Wildlife Service emailed customers to say Bookeasy had been compromised. The state's environment department told ABC Radio Brisbane that the provider had been hacked. ABC News reported that the parks booking systems in Victoria and South Australia were also affected. South Australia's National Parks and Wildlife Service later told customers that names, contact details and booking information may have been accessed.
- 12 November: 7NEWS reported that a visitor centre operator in Western Australia had separately confirmed a security incident involving the same provider. No other outlet has confirmed this so far.
- 13 November: Bookeasy's status page said its containment work was finished and "validated by independent third party experts", and that partners could take bookings again. Parks Victoria's update on the same afternoon said Bookeasy was still "working with an external third-party expert to validate" containment. Victoria's system stays offline, with the next update due on 16 November. Accounts differ on whether validation was finished at that point.
- 14 November: The ACT government suspended Bookeasy. It said the parks booking system and VisitCanberra were both affected, and that some Canberra campers had received suspicious messages. SSBCrack News quotes ACT government executive group manager Bren Burkevics: "Bookeasy has notified the ACT government that they have incurred a cyber incident and potentially the unauthorised release of information... in the abundance of caution, the ACT government has suspended the use of that website." People can still book directly through government parks websites.
What Was Taken
Bookeasy says the exposed data covers customers' personal and booking information: name, home address, email address and phone number, plus booking records. Queensland, South Australia and the ACT gave similar descriptions.
Financial data appears to be safe so far. Bookeasy says it has "not identified any access to credit card details" based on its investigation to date. Queensland's environment department says payments go through a separate system. Both statements are hedged with "at this stage" or a similar phrase.
No one has published a total number of affected people. The only figure available is the ACT government's email to about 6,000 users. That is the number of people warned in one jurisdiction, not a confirmed count of exposed records. Bookeasy also says that "gaining certainty over what was accessed is not always possible". The company has said it will contact affected partners directly. If a partner has not heard from Bookeasy, it means the company has no direct evidence that partner's customer data was accessed.
Why It Matters
One supplier, many governments. A single private platform holds booking data for parks agencies in at least four states and territories, plus tourism operators. A breach there spreads across every agency that relies on it. The same pattern showed up in May, when Queensland's Education Department was affected by a breach at education technology supplier Instructure.
The data is already being used. Victoria and the ACT both say customers have received suspicious WhatsApp messages and emails since the breach. With a name, phone number and a real upcoming booking, a scammer can pose convincingly as park staff, for example by asking for "payment confirmation" or a "permit fee". 7NEWS points out that this is happening weeks before the Christmas camping peak, when many people have bookings coming up. Bookeasy itself notes "an increase in scam attempts targeting the travel industry".
Services go down. Victoria and the ACT have both turned off their booking systems. Agencies that depend on one supplier have no backup when that supplier is compromised.
The Attack Technique
Bookeasy has not said how the attackers got in. It says only that a "security alert" led to "immediate containment action". The company has not said whether a vulnerability, stolen credentials, a compromised partner account or something else was involved. No group has claimed the attack, and no ransom demand or data leak has been reported. No regulator filing or national CERT advisory has been published.
What can be seen is what happened next. Scammers contacted customers through WhatsApp, text and email, posing as parks agencies and using details that appear to come from booking records. This suggests the main goal was harvesting contact and booking data for fraud. Do not read anything more into it until Bookeasy releases forensic findings.
What Organizations Should Do
- List your third-party booking and CRM platforms. Work out exactly which customer fields each one stores. Ask Bookeasy and similar suppliers directly whether your data was accessed instead of waiting to hear from them.
- Warn customers early and specifically. Name the channels being abused (WhatsApp, text, email). State plainly that your staff will never ask for payment or card details through them. Give one official address for reporting, as Queensland did with [email protected].
- Prioritise customers with upcoming bookings. Booking-based scams work best before the trip happens. Contact these customers first, and include past customers too, as Bookeasy also recommends.
- Keep a manual fallback. Have a direct or offline booking process ready so you can switch a compromised supplier off without shutting down services.
- Write data limits and breach terms into supplier contracts. Store only the customer data you need. Require timely breach notice, forensic reports and evidence of independent validation before you reconnect.
- Watch for impersonation. Look out for lookalike domains, fake WhatsApp business profiles and spoofed sender addresses that use your agency's name, and request takedowns quickly.
Sources: ACT campers', visitors' data breached after hacking of government b... | Personal user data breached after Qld, Victoria and SA's National P... | Qld government: Personal information may have been accessed in data... | Bookeasy Status Update - Bookeasy | Bookeasy parks booking breach reaches the ACT | ACT Government Warns Campers After Bookeasy Cyber Breach Exposes Pe... | Suspicious WhatsApp messages linked to booking system issue | Customer details potentially exposed in national parks booking syst...