- Amadeus iHotelier booking platform suffers security breach
- Unauthorised access to customer reservation data
- Data includes names, emails, phone numbers and booking references
- Passwords, payment data and passport details not exposed
- Security experts warn of targeted phishing campaigns
The Amadeus iHotelier booking platform has suffered a security breach that was publicly disclosed in September 2026. The incident involved a third-party provider and resulted in unauthorised access to customer reservation data across numerous hotels that utilise the engine for direct online bookings. Stolen data includes customer names email addresses phone numbers postal addresses booking reference numbers and specific stay details such as dates and rates. Affected hotels have stated that passwords payment data and passport details were not exposed during the incident.
According to notifications from affected partners like the German hotel group Maritim hackers managed to compromise reservation lists for hotel stays scheduled between August 2026 and September 2027. 7Hotel and Spa in Illkirch-Graffenstaden France confirmed unauthorised access to customer reservation data. Because the stolen dataset pairs highly specific booking details with direct contact information security experts warn of highly targeted phishing campaigns. Attackers can use exact check-in dates rates and hotel choices to craft convincing fraudulent messages via email or WhatsApp.
They typically pose as hotel staff demanding payment verification or a deposit to prevent a reservation from being cancelled. Safety recommendations include verifying directly with hotels through official verified telephone numbers or websites and never clicking on payment links sent via text WhatsApp or unsolicited emails. Travellers should monitor bank and credit card statements for any unusual or unauthorised activity and watch for official data breach notifications from hotels where they have active reservations.
