Holiday park guests targeted by scammers after booking software provider breach

Travellers who have booked stays at major Australian holiday parks are being warned about fraudulent messages after a breach involving a third-party booking platform. Operators including Reflections, BIG4 and G'day Parks are understood to have been affected through RMS Cloud, an Australian provider of cloud-based property management and booking systems. According to its website, the company serves more than 6,000 hotels, holiday parks and serviced apartments worldwide. The ABC has contacted RMS Cloud for comment.

BIG4 said some guests have received fraudulent messages asking for credit card or payment details. Reflections Holidays sent its own text message to guests, saying its booking system provider had made it aware of phishing emails claiming booking payments had failed. The message urged guests not to click links or share payment details. A BIG4 spokeswoman said RMS is investigating, and parks that may be affected have been given preliminary advice for their customers.

The scam appears convincing. Cherie Midson, who manages a holiday park in East Gippsland, Victoria, said some details in the messages, such as names and dates of stay, are correct. Her guests began calling the business the day after the messages started going out. She has reported the matter to the federal government's Scamwatch site.