A partner’s credential misused
Kempinski has written to guests with upcoming reservations. In the letter, the group explains that an unauthorised third party used an access credential belonging to one of its technology partners. This access allowed part of the reservation information to be viewed.
The group says it revoked the credential and closed the access route as soon as it discovered the incident. It has also launched an investigation with an independent cybersecurity specialist. A spokeswoman confirmed to the German news agency dpa that Hotel Adlon Kempinski Berlin, which faces the Brandenburg Gate, is among the properties affected.
Passport numbers possibly exposed
According to the initial findings of the investigation, the data involved includes guests’ names, contact details (email address and phone number) and booking details: hotel, dates of stay and confirmation number.
The group states that no payment card data was accessed, as this information is not stored in the compromised system. It remains cautious about other information, however, saying it can neither confirm nor rule out that sensitive personal data, such as passport or visa numbers, has been affected.
Kempinski stresses that reservations remain confirmed. The group has disclosed neither the number of guests affected nor the name of the technology partner.
Fraudulent payment requests via WhatsApp
The main risk lies in fraudulent messages. Kempinski confirms that guests have been contacted by third parties posing as its hotels via email, SMS or WhatsApp. These messages quote genuine reservation information, such as the confirmation number and dates of stay, to appear authentic.
They typically request a payment, or confirmation of bank details to “secure” the reservation via a link. The group points out that it will never ask guests to confirm bank details via a link, nor to make a payment through a link sent on WhatsApp.
Kempinski advises guests who have already paid to have their card blocked, dispute the transaction with their bank, file a police report and keep all evidence of the exchange. The group offers to provide them with a written statement confirming that the charge was neither authorised nor processed by the hotel. A dedicated address, breach-notification2026@kempinski.com, can also be used to check whether a message is genuine.
Tighter protection for partner access
Kempinski says it is working with the partner concerned to strengthen the security of their shared data ecosystem, in particular the protection and monitoring of credentials entrusted to partners. The group has also notified the relevant data protection authorities, as required by regulation.
A threat intensifying with AI
The incident comes as Booking reports a rise in AI-assisted scams. On 12 November, at Web Summit in Lisbon, its chief information security officer, Marnie Wilking, explained that the quality of AI-generated translations is enabling fraudsters to target markets they had previously reached only to a limited extent, notably Japan and China.
In her view, attackers exploit the trust that characterises the sector by posing as a hotel, a partner or a booking platform. According to a report by Israeli cybersecurity firm Check Point, attacks on hospitality, travel and leisure rose by 50% in 2025. Booking is also the subject of a European Commission investigation into how it protects customers against phishing.
The platform says it uses AI itself to block fake reservations and verify the identity of both users and accommodation providers. It reports having blocked 14.6 million attempted fraudulent transactions in 2025, 22% more than the previous year.
Analysis – Suppliers, the blind spot in hotel security
Analysis – The Kempinski case shows that a group’s security also depends on that of its suppliers. Here, the leak stemmed from a credential entrusted to a technology partner, not from the group’s own systems. For owners and operators, managing the access granted to suppliers is becoming a governance issue in its own right, all the more so as reservation data directly fuels fraud targeting guests.
At a glance by The Hospitality Tribune
Kempinski discloses guest data breach via third-party credential
Unauthorised party misused a technology partner’s access credential to reach upcoming reservation data
Exposed: names, emails, phone numbers, hotel, stay dates and booking confirmation numbers
No payment card data involved; passport or visa numbers cannot be ruled out
Hotel Adlon Kempinski Berlin among affected properties
Guests targeted by fraudulent payment requests via email, SMS and WhatsApp
