South Africa’s accommodation industry is facing a string of cyberattacks that target guests’ private details, MyBroadband reported. Criminals use the stolen data to trick people into paying money.
Booking.com, LekkeSlaap, NightsBridge and Hospitality Technology International (HTI) have all reported data breaches since the start of the year. These are only the incidents that were made public.
“If you have a guesthouse booking for December, the WhatsApp asking you to pay a deposit into a new account may know your real reference number,” local cybersecurity researcher Willem Steynberg said.
NightsBridge, which links accommodation businesses to booking technology, warned its clients and customers about a breach. The company told MyBroadband that an AI agent was used to break into a back-office summary list.
That list held full names, email addresses, contact details and booking reference numbers. It also held other information about client companies.
“The booking summary accessed had very limited information. No sensitive guest information or payment information,” NightsBridge managing director Theresa Emerick said.
“Unfortunately, the actual booking data (dates and booking number) gave enough information to create a WhatsApp spoof that could have looked fairly realistic,” she said.
Booking.com told some South African users that their private data had been exposed. South Africans have reported reservation hijacking attacks since that breach and leak.
“Based on the findings of our investigation to date, accessed information could include booking details, names, emails, addresses, phone numbers, and anything that you may have shared with the property,” Booking.com warned.
Steynberg shared more details about the LekkeSlaap breach in his latest cyber threat brief. LekkeSlaap is one of South Africa’s largest accommodation booking apps.
“LekkeSlaap told guests that names, email addresses, phone numbers and booking references were taken through its calendar-sync system,” Steynberg said.
“No card numbers or ID numbers in either case, and in both cases the harm lands on people who never dealt with the platform directly,” he said.
LekkeSlaap connects customers with more than 40,000 properties across Southern Africa. It has served over 9 million guests since it launched.
Executives at NightsBridge and HTI have both said the industry is under attack from cybercriminals. The sector was worth about R200 billion in 2026, according to a Mordor Intelligence report.
The stolen data is used in reservation hijacking scams. Scammers pretend to be hotel staff and use real company names to win a guest’s trust.
“Reservation-hijack scams are when a scammer takes over a hotel’s account and begins impersonating the hotel,” cybersecurity expert Boikokobetso Makhetloane said earlier this year.
Scammers use AI to write messages that look real, using genuine booking details. A common warning sign is a message that pushes the guest to act fast.
“What these guys have done is say, ‘Hey, you need to pay the remaining amount for your accommodation, so here’s a link to make the payment’,” Makhetloane said.
The scammers say the link will expire in five to 10 minutes and the booking will then be cancelled. Makhetloane urged South Africans with recent bookings to double-check any message from a hotel or hospitality company.
Source: this article is based on reporting by MyBroadband. Image: MyBroadband. Written with the help of AI and published by the Tzaneen Voice Business desk. See our Editorial Standards.
Anelisa Nkuna covers business and money news for Tzaneen Voice. Anelisa reports on the rand, fuel prices, interest rates, jobs, Eskom, Transnet, farming and company results. The aim is simple: explain what the numbers mean for household budgets, small businesses and workers in South Africa.