Phishing · Identity
Australian holiday park guests targeted by booking scam after software breach
Scammers are sending fake payment requests to guests of major Australian holiday parks after a breach at a third-party booking platform. Travellers are warned not to click suspicious links or share payment details.
Ross Grant2 min read
The short version
Scammers got access to booking details from a company that handles reservations for many Australian holiday parks. They are using this information to send fake messages to guests, pretending to be from the park, and asking for credit card details. The messages look real because they include actual booking information. Guests are being warned not to click on links or share payment details in these messages.
By the numbers
- 6,000+hotels and holiday parks using RMS Cloud worldwideABC News (Australia)
- 13,000+phishing scam reports to Scamwatch in first three months of 2026ABC News (Australia)
What happened?
Scammers are targeting guests of major Australian holiday parks with fake payment requests after a breach at booking software provider RMS Cloud. Attackers are using real booking details to send convincing phishing messages by email, SMS and WhatsApp. Park operators and RMS Cloud are warning guests not to click suspicious links or provide payment details. The breach is under investigation, and no payment card data is said to have been exposed.
Who is affected
Guests of major Australian holiday park operators, including BIG4, Reflections Holidays, G'day Parks and Summerstar Tourist Parks, have been targeted. These parks use RMS Cloud, a booking management software provider that serves over 6,000 hotels and holiday parks worldwide, according to its website. The breach appears to have affected guests with upcoming bookings, as scammers are using real booking details to make their messages more convincing.
What was taken
The scammers are using information such as guest names and dates of stay, which suggests that booking details were accessed. RMS Cloud has stated that no payment card information was exposed from its systems. However, the exposed data is enough for attackers to craft believable phishing messages.
How the attack worked
According to ABC News (Australia) (opens in a new tab), scammers are sending fraudulent emails, SMS and WhatsApp messages to guests. These messages reference genuine booking information and claim that a payment has failed or needs to be verified. The goal is to trick recipients into clicking a link or providing their credit card details. Park operators have reported that the messages started circulating overnight and that guests began contacting them with concerns soon after.
The response
RMS Cloud has said it is investigating the incident and taking steps to contain it, protect customer information and support affected clients. Park operators have contacted guests with warnings and advice, urging them not to click suspicious links or provide payment details. Some, like Reflections Holidays and Summerstar Tourist Parks, have posted public alerts on social media. At least one park manager has reported the scam to the Australian government's Scamwatch service.
Has this happened before?
ABC News notes that this is not the first time travellers have been targeted in this way. Earlier in 2026, Booking.com guests were hit by a similar phishing scam involving fake hotel messages sent via WhatsApp and email, using personal booking details.
What you should do
Travellers who receive unexpected messages about their bookings should not click on any links or share payment information. Instead, they should contact the accommodation provider directly using official contact details. Businesses using third-party booking platforms should review their security arrangements and remind staff and guests to be alert for phishing attempts.
Why it matters
This breach shows how attackers can use even basic personal information to make scams more convincing. People planning holidays are often distracted and may trust messages that include real details about their bookings. Businesses that rely on third-party software need to ensure their partners have strong security.
Key points
- Scammers used real booking details to target holiday park guests.
- Phishing messages were sent by email, SMS and WhatsApp.
- No payment card data was exposed, according to RMS Cloud.
- Park operators and RMS Cloud have warned guests not to share payment details.
- Similar scams have targeted travellers before.
Sources
ABC News (Australia)
Reference
