The Spanish Data Protection Agency (AEPD) warned of a significant increase in cyberattacks targeting hotel reservation systems in July. A total of 919 personal data breaches were reported to the agency in July. This number was recorded as 518 in June and 282 in July 2025.

Although the data does not only cover attacks in the hotel sector, the AEPD specifically highlights the increase in criminal access to the reservation systems of accommodation establishments. The compromised reservation information can then be used in fraud attempts directly targeting hotel customers.

Reservation Data Becomes a Tool for Fraud

Attackers access reservation details along with customers' personal information from hotel systems. This information makes fraud messages appear highly credible.

According to the AEPD, attackers reach out to customers via reservation platforms, email, or messaging services, claiming there is a problem with payment and demanding that the reservation fee be paid again. The agency states that these attempts have been successful in some cases, causing financial harm to customers.

This method can lead to various crimes, including identity theft and fraud.

Security Warning to Hotels

The AEPD emphasizes that the responsible data managers of attacked hotels must report incidents to the police or judicial authorities.

The agency also requests that hotels pay attention to the selection of personnel involved in reservation and personal data processing and work with service providers that can ensure an adequate level of security.

In its report, the AEPD warns, “Hotel establishments should only use reservation management services that can guarantee an adequate level of security for their customers' personal data.”

Reservation Data a Critical Target in Tourism Sector

For hotels, the danger of attacks is not limited to data loss alone. The ability of criminals to use real reservation details increases the likelihood of customers believing fake payment requests are genuine.

The sharp rise in data breaches reported in July indicates that protecting hotels' reservation infrastructure and customer data during peak travel seasons is becoming increasingly critical for the tourism sector.

Source: https://www.tourinews.es/sucesos/hackers-hacen-su-agosto-en-julio-cibeartaques-hoteles-estafar-clientes-se-dispararon-mes-pasado_4494200_102.html

Image: © AI-generated image