At least 100 hotels in the Netherlands have been hit by a data breach in which attackers stole customer records and reservation details, with reports now also coming in from Belgium and Ireland. The breach is being exploited in phishing campaigns that pressure travellers into fraudulent payments under threat of cancellation.

"We are being flooded with new reports. In the Netherlands, at least one hundred hotels have been affected. But reports are also coming in from Belgium and Ireland," Tim Vissers, Managing Director at Hospecs, told Dutch broadcaster NOS. Hospecs, a hospitality sector body, is coordinating the sector's response.

Vissers confirmed on LinkedIn that the stolen data has already been weaponised against guests. Phishing messages tell travellers to pay for their reservation or risk having the booking cancelled.

Where is the vulnerability?

The weakness most likely sits in the software hotels use to handle reservations. "There are several layers between making a reservation and confirming it, including the processes for confirming a reservation and setting a price. It appears that the vulnerability lies in one of those systems," Vissers said.

That framing points the investigation toward booking and rate-management middleware rather than individual property systems. Hospecs is now collecting data to map which hotels are affected, which systems they run and exactly what was stolen.

What has the phishing cost guests?

Belgian newspaper Het Laatste Nieuws reported that hundreds of Flemish hotel guests have fallen victim to phishing built on the breached data. In some cases, damages run to thousands of euros per victim.

The attack pattern matters for operators: criminals use genuine booking details — names, dates, destinations — to make payment demands look credible. Guests who pay lose the money; guests who ignore the messages risk genuine confusion over their reservations at the front desk.

Hotels that have been compromised are asked to fill out a form Hospecs published on its website earlier this week.

What are regulators doing?

The Dutch data protection authority (AP) has opened an investigation into the breach. The probe sits alongside a wider wave of attacks on the travel sector:

• October 2025: Dutch travel agency Sunweb Group confirmed an unauthorised party stole client data — full names, email addresses, phone numbers and booking details including travel dates and destinations. No bank details, passwords or passport data were compromised.
• April 2026: Booking.com suffered a breach exposing names, email addresses, phone numbers, residential addresses and other information shared with accommodations.

In both cases, criminals followed up with phishing attempts designed to trick victims into transferring money to scammer accounts — the same monetisation model now hitting the affected hotels.

What happens next?

The AP investigation will determine whether affected hotels face notification failures or GDPR fines, while Hospecs' data-collection exercise should identify the specific vulnerable software layer and the true scale of the compromise across the Netherlands, Belgium and Ireland.