VID International
Situation report · as of 2 November 2026

Cyberattacks on tourism: what happened and what businesses can do now.

At the end of October, a major data leak in Austrian tourism became public: in the night of 25 to 26 October, an attacker used misused credentials of an interface partner to retrieve guests' booking data, not via the IT of individual hotels. It is the most visible case in a series that has been hitting hospitality service providers across the Alps since January 2026. Here you'll find the facts from public sources and concrete next steps.

What to do now
around1,700potentially affected businesses in five Tyrolean tourism associations, about a third with upcoming bookingsORF Tirol / ORF Salzburg, 31 Oct 2026
600Tyrolean businesses had come forward by 31 October, a subset of the 1,700Tiroler Tageszeitung, 31 Oct 2026
97hotels affected in Salzburg, in eleven or twelve tourism associations depending on the sourceORF Salzburg / Salzburg24, 31 Oct 2026
around3,000affected guests in Styria, all Styrian tourism associations affectedORF Steiermark, 31 Oct / Krone, 30 Oct 2026

As of 31 October / 1 November 2026. The figures refer to different units and must not be added up: the 600 reported businesses are part of the 1,700 potentially affected, and the 3,000 are guests, not businesses.

What happened

Two incidents in Tyrol are currently known. A connection between them has not been confirmed, so we present them separately. Both belong to a series of incidents at hospitality service providers that has been running since January 2026.

Incident 1 · Booking platform Feratel

Credentials of an interface partner misused

Via a third-party system, an attacker obtained the Deskline credentials of an external interface partner of Feratel. In the night of 25 to 26 October 2026, between 23:00 and 01:15, they used them to retrieve bookings with upcoming arrival dates. Tourism associations in Tyrol, Salzburg and Styria are affected.

Name, address, phone number, email, travel dates, booked property, travel price and payment status were retrieved. According to current information, credit card, payment and registration data are not affected. Feratel stresses that its own core system was not compromised; the data protection authority has been informed.

Tourism associations have been asked to reset all WebClient passwords and remove the phone number field from the booking form; sign-in with a second factor (MFA) is available. Seefeld has temporarily taken the affected systems on its website offline and is contacting guests directly.

Incident 2 · Software company in the Schwaz district

Attack on a web application for bookings

Between 17 October, 10:00, and 28 October, 13:30, unknown attackers broke into a web application used to process bookings for accommodation providers in several countries and obtained customer data. Customers then received messenger messages with a link to “confirm the booking”, which requested credit card data.

Whether card data was actually stolen has not been confirmed; the number of people affected and the damage are unknown. According to the Tyrol police, the problem has been fixed and investigations are ongoing. Whether this company is the interface partner from incident 1 has not been confirmed.

What is affected and what is not

What matters for your assessment is which data is in circulation. The details refer to the Feratel incident as of 2 November 2026.

Retrieved (according to Feratel)

  • Name
  • Address
  • Phone number
  • Email address
  • Travel dates (arrival and departure)
  • Booked property
  • Travel price
  • Payment status

Not affected (according to current information)

  • Credit card data
  • Other payment data
  • Registration data
  • Bookings via the portal; the reported fraud messages concern the “Internet” sales channel
  • Feratel core system (according to the company)

Regions

Tyrol
Five tourism associations: Seefeld, Serfaus, Ischgl, Stubai and St. Anton. Only ORF Salzburg names St. Anton; the association has not issued its own statement.
Salzburg
97 hotels. ORF Salzburg names eleven tourism associations, ORF Österreich and Salzburg24 twelve.
Styria
All tourism associations, around 3,000 guests.
Carinthia
Not affected according to Feratel.
Upper Austria, Vorarlberg, Burgenland
No cases reported. This is not an official all-clear.
Trentino
According to Italian media, guests who booked via the Feratel platform provided by Trentino Marketing are also affected. No figures are available.

The original leak contains no credit card data. The attackers try to obtain it afterwards through fake messages.

How the attackers operate

The messages look genuine because they contain real booking data: name, accommodation, travel dates, often the travel price and an open deposit too. Attention alone is therefore not enough; technical and organisational measures are needed as well.

Contact via WhatsApp, text message or email

Guests receive messages that appear to come from the hotel or the booking platform, often from foreign numbers and with an exact demand such as “your deposit is still outstanding”.

Link to “confirm”

The link leads to a fake payment page, sometimes pre-filled with real booking data. There, credit card details, CVV codes or online banking credentials are requested.

Time pressure and refunds

Deadlines of 12 or 24 hours are typical, or the room will supposedly be cancelled. After the stay, a second scam follows: an alleged refund or “corrected invoice”.

What businesses can do now

The weak point is often not the hotel PC, but access credentials, interfaces and service providers. You should check these points now.

Access and MFA

Check access to the booking platform (such as Feratel WebClient and ExpertClient), hotel software, channel manager and email, and enable sign-in with a second factor everywhere.

Reset passwords

Change all credentials connected to the affected service provider and get rid of shared logins.

Preserve logs

Secure access logs from the night of 25 to 26 October, especially for upcoming bookings. Do not delete anything or rebuild systems before the cause is clear.

Review the phone number field

If possible, remove the phone number from the booking form. That at least takes the WhatsApp route away from the attackers.

Forwarding and payments

Check email forwarding rules, accept no new account numbers and no payment links via chat, and confirm approvals only through a second, known channel.

Make your channels clear

State on your website and in the booking confirmation that you never request card details via WhatsApp, text message or link, and give an official number for questions.

Inform your guests

Inform all potentially affected guests, not only those who have already received a fake message. You'll find a template below.

The 72‑hour notification chain

Within 72 hours, controllers must assess whether a notification to the data protection authority (Art. 33 GDPR) and informing guests (Art. 34 GDPR) are required. Clarify in advance: who notifies, who documents, who talks to guests? Also check your cyber insurance; many policies require notification within 24 to 72 hours.

These notes do not replace legal advice. The data protection authority has been informed of the incident; there is no public checklist specific to this case. The frequently cited checklist from LfD Niedersachsen comes from a German authority. The Austrian Hotel Association (ÖHV) has published a guide, “Datenverlust bei Vertragspartner”.

What to tell your guests

Five rules for communicating with guests and a template you can adapt and send by email.

Five rules

  1. 1Never request card details, CVV codes, text message codes or online banking credentials via WhatsApp, text message or link.
  2. 2Always refer to your official phone number and your official website.
  3. 3Do not set deadlines. Real businesses do not push guests with 12 or 24 hours.
  4. 4Anyone who has already entered data: block the card, inform the bank, report it to the police.
  5. 5Inform everyone potentially affected, not only those who have already received a fake message.

Template

Subject: Important security information about your booking

Dear guest, we have been notified of a security incident at a booking service provider. Your booking data may be used for fake messages. We will never ask you via WhatsApp, text message or email link to enter credit card details, CVV codes or online banking credentials. Please verify payment requests only via our official phone number. Do not click on links in unexpected messages. If you have already entered data: have your card blocked immediately, inform your bank and report it to the police. For questions, you can reach us at [phone]. Kind regards [Name, position]

The template does not replace checking whether informing guests is mandatory under Art. 34 GDPR.

How we help

Factual, without scaremongering and without promises of one hundred percent security. The crash course and briefing are free for tourism associations and their member businesses.

Free initial consultation

In 15 minutes we clarify whether and where your business is affected, which access points and interfaces you should check and which steps make sense now.

Free 30-minute crash course

For the member businesses of a tourism association, online or on site: what happened, how the attackers operate, immediate measures, the 72-hour notification chain and guest communication. Product-neutral, with a checklist and templates instead of sales slides.

60-minute briefing for association teams

A confidential assessment of your own booking and communication channels and an order for the next steps. Free and without obligation.

Timeline

October did not come out of nowhere. Since January 2026, incidents have repeatedly hit hospitality service providers: booking platforms, channel managers, hotel software, email accounts. A common perpetrator has not been established.

  1. 15 Jan 2026easybooking: more than 1,000 customers receive phishing emails via hacked email accounts of individual businesses; according to the company, no data leak (TT)
  2. 13 Apr 2026Booking.com confirms unauthorised access to booking data and resets booking PINs; no financial data (ORF)
  3. 24 Jul 2026ÖHV publishes its guide “Datenverlust bei Vertragspartner” (ÖHV)
  4. 25 Jul 2026ibelsa (Germany): unauthorised access to guest and partner data; no payment data (ibelsa)
  5. 11 Aug 2026Seekda detects a security incident; by 13 August, 25 hotels report an incident to the data protection authority (Seekda, heise)
  6. 20 Aug–19 Sep 2026HotelNetSolutions (Germany): attacks via an interface of the platform used by more than 2,500 hotels; guests suffer financial losses (heise)
  7. 11 Sep 2026Amadeus iHotelier: suspicious access to reservation data; Maritim then informs 8,716 guests (HOGAPAGE)
  8. 1 Oct 2026Villach tourism association: management email account hacked, almost 600 fake invoices sent (5min.at)
  9. 17–28 Oct 2026Attack on the web application of a software company in the Schwaz district (Tyrol police)
  10. 23 Oct 2026Secra Bookings (Germany): data exported, in some cases including bank details and access codes (HomeToGo)
  11. 25/26 Oct 2026Feratel: upcoming bookings are retrieved between 23:00 and 01:15 using misused credentials of an interface partner (Feratel via Borncity)
  12. 26 Oct 2026TCS Camping (Switzerland) warns 15,000 guests after a security flaw in its booking system (SRF)
  13. 28 Oct 2026First major coverage in Tyrol, tourism associations warn hosts (TT)
  14. 29 Oct 2026Seefeld takes affected systems on its website offline and contacts guests directly (Gemeinde Seefeld)
  15. 30 Oct 2026Styria: all tourism associations affected, around 3,000 guests; Carinthia not affected according to Feratel (Kleine Zeitung)
  16. 31 Oct 2026Around 1,700 Tyrolean businesses in five associations potentially affected, 600 reported; 97 hotels in Salzburg (ORF, TT)
  17. 2 Nov 2026No new official figures; no public press release from Feratel, no case-specific statement from the data protection authority (own research)

Sources

We rely on leading media, authorities, associations and statements from the companies. We do not use headlines or AI-generated news sites as evidence; where sources contradict each other, we give both figures. There is no total damage figure, and the number of affected guests in Tyrol and Salzburg is unknown.