Your hotel stay data may have leaked through Misterbooking's booking software

On October 19, at 9:05 a.m., the vendor of the Misterbooking hotel management software detected unauthorized access to one of its servers. The intruder was cut off by late morning. But according to messages the vendor sent to its hotel customers, some data had already been extracted.

Misterbooking is published by Septeo Hospitality Solutions, a subsidiary of the French group Septeo, which acquired it in 2025. The software handles bookings, guest records and operations for about 1,800 hotels, according to the vendor. The people exposed are therefore not the hotels themselves, but their guests: you, if you have stayed at one of these establishments.

What could the hackers have taken?

According to the vendor's email as reported by Fuites Infos, the data covers the identity and contact details of guests and the people staying with them, their bookings, and the documents hotels attached to the files. FrenchBreaches, which had access to the vendor's communications, also cites dates of birth, nationalities and ID document numbers. The attachments could include copies of identity documents, and accompanying guests may include minors.

According to FrenchBreaches, the intruder allegedly exploited a software vulnerability to access the production database, but the origin of the incident is still under investigation. It adds that no full bank card data was extracted or accessed, as that data is stored on a separate payment infrastructure.

Several questions remain open: how many people and hotels are affected, exactly what data was taken, and who is behind the attack. No claim of responsibility has been spotted so far, and no fraudulent use of the data has been established. Septeo says it is continuing its investigations. The service is partially unavailable while the affected functions are isolated.

The trap: a fake message from the hotel that knows your dates

A fraudster who knows your name, your hotel and your stay dates can write a very convincing message. That is precisely what the vendor is asking hotels to warn their guests about: messages that cite stay dates and ask for a payment or for bank card details to be entered again.

• Never pay following a message received by email, SMS or messaging app, even if it cites your exact booking. Call the hotel back at the number on its official website.
• Do not send a copy of an ID document in response to a message.
• Hoteliers: change the passwords of your Misterbooking accounts, as the vendor requests, inform your teams and assess whether to notify the CNIL (the French data protection authority). As the controller of your guests' data, that decision is yours.

The case recalls other past leaks through a service provider, such as the one that hit the health reimbursements of Malakoff Humanis customers. It is now up to the hotels to notify their guests. How many will do so, and when, remains to be seen.