Booking Platform Breach Fuels Convincing Scam Messages to Australian Travellers

Customers across Australia are receiving scam messages after a data leak involving booking provider RMS. Hackers accessed names, booking information and contact details. Travellers to Western Australia's Kimberley region say the messages were convincing because they included accurate details about upcoming stays.

Sydney resident Cameron Craig received a WhatsApp message about his booking at Cable Beach Club in Broome. It used his full name and correct travel dates, and asked him to enter payment details through a link or risk losing the booking. He entered some card information before the session timed out. He later noticed the message came from an international number and the reservation code was wrong. He told the resort, which then notified guests. Kimberley Accommodation Group, which also uses RMS Cloud, said guests had reported similar messages. Managing director Dannielle Hart advised guests not to respond to unexpected messages, click links, give card details or make payments in response to booking communications. A cybersecurity expert said scammers were using fear and "weaponising urgency".

RMS says the unauthorised activity was contained and investigations continue into the full scope and impact. Its chief executive, Adam Seskis, said scams had become increasingly sophisticated, but confirmed credit card and payment details were not involved in the breach. The accommodation group could not say how many customers were affected or whether any lost money.