Fraudulent messages built on genuine bookings
The case began on 27 October 2026. That day, RMS, which publishes a third-party hotel management platform used by many accommodation providers, informed Ascott that it was investigating phishing messages received by guests. The messages arrived via WhatsApp, SMS and email.
The messages were convincing because they included genuine booking details. They then asked recipients to confirm their payment details or to pay a sum of money. Ascott quickly stated that neither the group nor its properties had sent them.
In that initial statement, the group said RMS had found no exposure of payment card data from its platform. It asked affected guests not to click on any links and to contact their property directly, using the contact details published on its official website.
Unauthorised access to the RMS platform
On 12 November, Ascott published the results of the investigation. According to RMS, the fraudulent messages did indeed stem from unauthorised access to booking data stored on its platform. The provider says it has fixed the vulnerability and contained the threat.
Ascott, which now has more than 1,000 properties worldwide, reiterated that its own systems were not affected. RMS is continuing its forensic analysis, and the group says it will work with the provider until that analysis is complete.
Passport details among the exposed data
The records involved relate to bookings made before 27 October 2026. They contain guests’ names, contact details and stay information. In some cases, they also include passport details, where guests had provided them when booking.
The group confirms that no payment card information is involved. Passport data is, however, more sensitive than a simple email address. The relevant authorities have been notified.
Crisis management focused on informing guests
Ascott has decided to contact affected guests directly to help them protect themselves against further attempts. The group is urging them to be wary of any unexpected message, email or call that refers to their booking. Before clicking on a link or sharing any information, they should check that the request is genuine.
The group’s official contact channels are listed on Ascott’s global reservations page. Guests who may already have made a payment after receiving a suspicious message are advised to contact their bank or card issuer as soon as possible. For any other questions, the data protection team can be reached at data.protection@the-ascott.com.
The group has apologised for the concern and inconvenience caused to guests.
Supplier risk, the blind spot in hotel cybersecurity
Analysis – The Ascott case follows an increasingly common pattern. Attackers do not target the hotel group directly: they go through a technology provider that holds booking data. They then use that data to make scams aimed at guests highly convincing.
A few days ago, Kempinski warned its guests of a booking data theft linked to the misused login credentials of a technology partner, involving the same type of payment fraud via messaging. The industry has been familiar with this modus operandi since at least the campaigns run through Booking.com’s messaging system in 2023.
For owners, operators and asset managers, this means taking a close look at the access granted to providers of PMS, channel managers and distribution tools. The storage of identity documents in these systems deserves the same scrutiny. These issues are now as much a matter of governance as of IT.
At a glance by The Hospitality Tribune
Ascott guest data exposed through third-party PMS provider RMS
Phishing via WhatsApp, SMS and email used genuine booking details to request payments
RMS investigation confirms unauthorised access to reservation data; vulnerability fixed, threat contained
Records cover bookings made before 27 October 2026: names, contact details, stay data and, in some cases, passport information
No payment card data involved; Ascott’s own systems unaffected
Authorities notified, affected guests contacted directly, forensic investigation ongoing
