RMS Cloud Breach Triggers Targeted Guest Phishing Scams
Booking software provider RMS Cloud confirms a cybersecurity breach is fueling fraudulent payment requests for holiday park guests.
Updated on Oct. 27, 2026 in Cybersecurity
Live Poll
Do you trust that booking sites are doing enough to protect your payment details?
RMS Cloud, a booking software firm serving over 6,000 accommodation providers, has suffered a cybersecurity breach that exposed customer names and booking dates. Scammers are now using this information to contact guests at networks like Reflections, BIG4, and G'day Parks with fraudulent payment requests.
Why it matters
The breach allows scammers to present highly credible phishing messages to holiday park guests, increasing the likelihood of successful financial fraud. Because the messages contain accurate personal details, recipients may be more likely to trust the fraudulent requests for payment information.
RMS Cloud provides booking software infrastructure to over 6,000 accommodation providers across Australia. These systems hold sensitive booking data including customer names and stay dates, which were compromised in the recent security incident.
The players
RMS Cloud
A provider of comprehensive booking and management software for the hospitality and accommodation industry.
Scamwatch
A government agency that provides information to consumers and small businesses about how to recognise, avoid, and report scams.
Summerstar Tourist Parks
An operator of tourist parks that confirmed it received notification of the cybersecurity breach.
The details
Scammers are utilising email and WhatsApp to target guests with claims that their booking payments have failed. These messages include links that redirect victims to fraudulent websites designed to harvest credit card details.
Timeline
13,000 phishing scams were reported to Scamwatch during the first quarter of 2026.
Phishing messages began circulating to holiday park guests on 26 October 2026.
Holiday park operators confirmed the security breach on 27 October 2026.
The Tech Race
The incident highlights the increasing vulnerability of centralised booking databases as they become prime targets for sophisticated data-mining attacks. This breach marks a departure from generic mass-phishing attempts, showing an evolution towards highly personalised social engineering campaigns.
If you have recently booked a holiday stay, exercise caution with any unexpected payment failure notices received via email or WhatsApp. Avoid clicking links in these messages and contact your accommodation provider directly through their verified official website if you are unsure about your booking status.
The takeaway
Always verify payment requests by calling the holiday park directly rather than interacting with suspicious electronic messages. Genuine providers will not ask for sensitive payment details through unsolicited links sent over WhatsApp or email.
Further reading
For broader information on protecting digital information, visit the Cybersecurity section.
Source note: This article includes information reported by Australian Broadcasting Corporation.
Live Poll
Do you trust that booking sites are doing enough to protect your payment details?
