Scammers are sending travellers across Australia phishing messages that quote real reservation details. The data came from a breach at RMS Cloud, which makes property management and booking software for hotels, motels, holiday parks, campgrounds and serviced apartments. RMS says it found unauthorised access to "a limited part of its environment" on 26 October. Its current findings show that guest names, contact details and booking information were taken, but not credit card or payment details. The latest wave has hit travellers heading to Broome and the Kimberley in Western Australia, and earlier reports came from Tasmania, Victoria and New Zealand. RMS has not said how many guest records were exposed. Reports say about 6,000 accommodation providers worldwide were caught up, a figure that comes from Warrnambool City Council, which said RMS gave it, and from Insurance Business, which says RMS serves "more than 6,000" properties.
What Happened
According to RMS's 28 October statement, reported by AccomNews, the company found the unauthorised access on 26 October. Phishing messages had already reached guests by 27 October. That day, the Victorian branch of the Australian Nursing and Midwifery Federation (ANMF) warned members about a "potential data breach" of its RMS-hosted accommodation booking system and turned off its online booking link. Insurance Business quoted Cherie Midson, a holiday park manager in East Gippsland, who said "the messages started going out last night and the calls started coming in today."
7NEWS reports that RMS confirmed it was investigating on Tuesday 27 October. In an updated statement the next day, RMS said it was aware of "phishing communications sent by an unknown entity claiming to be RMS or one of RMS' customers." Chief executive Adam Seskis apologised. He said the company was working "around the clock with forensic, cyber and legal specialists." He also warned: "For travellers, a message quoting your booking details does not make it genuine."
Many accommodation brands have since warned their guests. They include BIG4, Reflections Holidays, G'day Parks and Summerstar Tourist Parks (named by ABC News, 7NEWS and Insurance Business), Federal Group's Wrest Point Casino in Hobart, and the Warrnambool City Council-run Surfside and Shipwreck Bay holiday parks. Moyne Shire Council's holiday facilities are also affected. Warrnambool council said it contacted about 6,000 customers of its two parks. The Ascott Limited has also published a statement about RMS's investigation into phishing messages sent to guests.
On 3 November, ABC News reported that the campaign had reached the Kimberley. Sydney resident Cameron Craig received a WhatsApp message about his upcoming stay at Cable Beach Club in Broome. It had his full name and the correct travel dates, and it told him to submit payment details through a link or lose his booking. Craig works in tech. He clicked the link and entered some of his credit card details before the session timed out. He later noticed the message came from an international number and the reservation code did not match his. He told the resort, and the resort then notified its guests. ABC reports that other Kimberley accommodation providers are also affected. RMS says it is still investigating the full scope and impact.
What Was Taken
Every account agrees on the main categories: guest names, contact information and booking details. Specific reports add more detail:
- Contact details: email addresses and phone numbers (ANMF's notice), which explains why victims are being reached by email, SMS and WhatsApp.
- Reservation data: booking dates and property location (ANMF). The Wrest Point scam email reproduced the guest's real booking number, room type and check-in and check-out dates (ABC News). Warrnambool council described the data as "names, contact information and booking dates."
- Past and future guests: ANMF says both members with upcoming bookings and those who had stayed before may be affected.
RMS, its customers and every report agree that credit card and payment details were not accessed. ANMF adds that payment details are not stored in its booking system at all.
Volume is unknown. RMS has not published a record count, and no regulator filing has been made public. The figure of about 6,000 refers to accommodation providers, not guests. Warrnambool's two parks alone contacted about 6,000 customers, so the total number of guests is likely much higher. One Warrnambool park owner told The Standard they were "hearing horror stories" of dozens of guests being scammed at other properties. That claim has not been confirmed.
Why It Matters
Stolen context is what makes this phishing work. None of the stolen data is sensitive on its own, but it makes the phishing very convincing. A message with your real name, dates, room type and booking number gets past the checks most people rely on. Craig's experience shows this: a tech worker, by his own account "pretty savvy," still entered card details. The aim of the attack is to collect payment card details at the phishing stage. Card data was not stolen in the breach, so the attackers are asking victims to hand it over.
One supplier, thousands of exposed brands. Each affected hotel or park did nothing wrong in its own systems, yet each now carries the reputational damage. As Midson put it: "Our details are being used, which reflects on us as a business." Insurance Business notes that operators are also facing questions from regulators. For any sector built on shared SaaS platforms, this is a clear example of supplier risk.
The window is long. Booking data includes future stays. Guests with trips months away stay attractive targets, and the time pressure built into each message ("pay or lose your booking") stays believable right up until check-in. A cybersecurity expert quoted by ABC News described the tactic as "weaponising urgency." Expect the campaign to keep going, and to move to new regions as more properties are worked through.
The Attack Technique
Initial access: not disclosed. RMS has said only that there was "unauthorised access to a limited part of its environment." It has not said how the attackers got in, whether credentials, an exposed integration or an exploited vulnerability was involved, or whether data was pulled through its API or partner integrations. Its statement to Insurance Business mentions supporting "affected customers and integration partners," but does not say whether integrations played a part. No group has claimed responsibility, and RMS calls the sender an "unknown entity."
Follow-on phishing: well documented. The scams reported across Tasmania, Victoria and WA follow the same pattern:
- Channels: email, SMS and WhatsApp, sometimes from international numbers.
- Pretext: a booking confirmation or warning that appears to come from the property or from RMS. The Wrest Point version opened with "Thank you for booking Wrest Point Casino."
- Hook: a claim that the card used for the booking was blocked by the issuing bank, or that the booking will be cancelled without payment.
- Payoff: a link to a card-harvesting page. A 7NEWS interviewee said the link showed a picture of the hotel and the exact room they had booked, which suggests the phishing pages are built for each property.
- Tell: in at least one case the reservation code did not match the real one.
What Organizations Should Do
- Notify guests early and clearly. Contact past and future guests through channels you already use. Say exactly what you will never ask for: for example, "we will never ask for card details by WhatsApp, SMS or email" (the ANMF approach). Give a verified contact address for checking suspicious messages.
- Brief front-desk and reservations staff. Give them a script for callers, a way to check whether a booking is real, and an escalation path for guests who have entered card details. Those guests should contact their bank and the police right away. Report campaigns to Scamwatch and ReportCyber.
- Hunt for lookalike infrastructure. Watch for typosquatted domains and cloned property pages that use your branding and photos. Request takedowns quickly, and report sender numbers to WhatsApp and the telcos.
- Review your supplier integrations. If you use RMS or a similar platform, rotate API keys and integration credentials, check which user accounts and partners can export guest data, and ask for the supplier's scope findings, dates and indicators in writing.
- Check your notification obligations. Australian operators should assess whether the data involved meets the Notifiable Data Breaches threshold under the Privacy Act, even though the breach happened at a supplier. Record that assessment.
- Put supplier risk into contracts. Require breach notification deadlines, forensic cooperation and data minimisation from booking platforms. Ask whether past guest data needs to be kept at all. ANMF's notice suggests old bookings were exposed along with upcoming ones.
Sources: Scammers target Kimberley travellers after international hotel book... | RMS hack sees 'convincing' phishing scam emails using real hotel bo... | Real bookings, fake demands: Holiday parks warn guests following RM... | Australian travellers targeted in sophisticated hotel booking scam... | Warrnambool city caravan parks hit by global booking hack The Stan... | ANMF (Vic Branch) accommodation potential data breach – On the Record | Booking platform hack exposes third-party cyber risk across Austral... | Statement Regarding RMS’s Investigation into Phishing Messages Rece...