Australian travellers who have booked accommodation at hotels, resorts and holiday parks across the country are being targeted by scammers after a major data breach.

The hack involves booking software provider RMS, which is used by thousands of accommodation businesses, including Discovery Parks, Big4 and G’Day Parks.

RMS CEO Adam Seskis revealed this week that the company was investigating the “unauthorised access” of part of its system.

He said it appeared to involve guest contact information and booking details, but not credit card or payment information.

However, some guests have received phishing messages via email, SMS or WhatsApp that falsely claim to be from RMS or one of its accommodation clients, quoting booking information and requesting confirmation of payment details.

“We are treating this matter with the utmost urgency, and recognise the concern and disruption this has caused our customers and their guests,” Seskis said.

“Travellers should remain vigilant as phishing and scam communications become increasingly sophisticated.”

The Australian Competition and Consumer Commission’s Scamwatch has also issued warned people not to assume a message is legitimate because it includes their booking details.

“Scammers may have access to this information,” it said.

“Don’t click the link or reply. If you’ve shared your credit card details, contact your bank immediately to cancel your card.”

 

View this post on Instagram

 

A post shared by Scamwatch (@scamwatchgovau)

Hobart’s Wrest Point Casino is one of multiple Tasmanian hotels targeted in the latest scam, according to ABC News, which reports that ALH Hotels have also been affected.

A convincing-looking scam email sent to one guest claimed that a “cross-border authorization check” on the person’s guarantee credit card had shown it was blocked by the bank. It said if a valid card could not be confirmed, the room would be released and the reservation cancelled “within 72 hours”.

The manager of a holiday park in Victoria’s East Gippsland, Cherie Midson, said she contacted ScamWatch after concerned guests alerted her that they had received phishing emails.

“It’s very worrying. Our details are being used, which reflects on us as a business,” Midson told the ABC.

“We’re concerned our guests could fall victim to the scam, and if they do, our business will be associated with that. That’s a real worry for us.”

Discovery Parks, BIG4, Summerstar Tourist Parks and Reflections Holidays have all warned guests about the third-party breach.

BIG4, which says about a third of its holiday parks use the RMS booking system, published a statement on its website explaining that some guests had received the fake messages requesting payment or card information. It also shared tips on how to spot phishing messages, along with examples.

“Travel is one of the most targeted industries for scams,” BIG4 warned.

“Bookings involve upcoming payments, real dates and a guest who wants to avoid losing their holiday, which makes urgent payment requests more convincing.”

Earlier this year, Booking.com revealed a data breach that saw travellers sent phishing messages.

Similar scams have been reported by Australian travellers who have booked accommodation through Agoda and Trip.com, according to a 7News report.

In its latest update on Thursday, RMS said it was continuing to monitor for suspicious activity while investigating the breach, adding it was “pursuing the removal of the websites and contact channels used in the scam”.

Meanwhile, it advises that anyone who receives a suspicious message should:

• Contact the accommodation provider directly before acting, using contact details from confirmed, official sources (website or original booking confirmation).
• Do not click any link contained within and delete the message.
• If you clicked a link, run an antivirus scan on your device and change your passwords.
• If you provided any payment details, contact your financial institution immediately and follow their advice.