A breach at booking software provider elloha is used to trap travelers on WhatsApp

They had booked accommodation, and their stay had not yet begun. Then travelers received WhatsApp messages inviting them to enter their bank details. The common thread: the property where they had booked used tools from elloha, a Perpignan-based vendor of booking and offer-distribution software for hosts and tourism professionals.

elloha confirms it. In a message to its client properties, relayed on October 27 by the specialist sites FrenchBreaches and Fuites Infos, the vendor says it detected a security incident on October 25 at 11:51 a.m. It says it blocked the access involved and deployed patches, and considers the incident resolved. The number of bookings and travelers affected has not been disclosed.

What data was exposed?

According to elloha, the incident involves travelers' first and last names and details of their booking records. The scope is still being assessed, but it is reportedly limited to upcoming bookings for which check-in has not yet been recorded. Phone numbers raise questions. elloha does not mention them, even though sending WhatsApp messages implies the scammers had them, Fuites Infos points out. FrenchBreaches, for its part, lists them among the compromised data.

One detail limits the damage. Booking and Airbnb hide their customers' email addresses behind intermediary addresses, which the fraudster could not exploit, according to the vendor. No theft of bank data from elloha's systems is confirmed at this stage: travelers are being pushed to hand it over themselves.

Why this trap works

A message sent to someone who is genuinely waiting to travel looks far more credible than ordinary phishing. This is not the first booking software provider hit this month: Misterbooking also reported a breach of hotel stay data.

What to do

If you have a stay booked in the coming weeks, assume that an unexpected message may know about your reservation.

• Never enter your bank details through a link received via WhatsApp or SMS, even if the message mentions your stay.
• If in doubt, contact the property using the contact details on your booking confirmation, never those in the message.
• If you have already entered your details, notify your bank immediately.
• The website cybermalveillance.gouv.fr offers free assistance.

For hosts, the matter is also a regulatory one. Under the GDPR, it is in principle the properties, as controllers of their customers' data, that must notify the breach to the CNIL (the French data protection authority). elloha, their processor, provides them with the information required by Article 33 for an initial notification, to be completed later. The list of potentially affected bookings can be found in the “Reservations” menu of their professional account. For its part, the vendor is preparing a notification to the CNIL and is gathering evidence for a possible criminal complaint.

Still to be determined are the number of travelers affected and the origin of the access, which elloha says it is still investigating.