BWH Hotels Says Attackers Accessed Guest Reservation Data for More Than Six Months
Summary
BWH Hotels says attackers accessed a web application containing guest names, contact details and reservation data from Oct. 14, 2025, until discovery on Apr. 22. Payment data was not stored there; the number of affected guests is unknown.
Key points
- BWH Hotels says its investigation found attackers had access from Oct. 14, 2025; the intrusion was discovered on Apr. 22.
- The accessed web application contained guest names, email addresses, phone numbers and reservation details.
- The company says payment and other financial information was not stored in the affected system and was not accessed.
- The number of affected individuals is unknown.
- BWH Hotels took the application offline and is investigating with external security experts.
- The company is concerned the accessed information could be used for scams or phishing; no cybercrime group has claimed responsibility.
Article Details
- Victim Organization
- BWH Hotels
- Incident Type
- Unauthorized access to a web application containing guest reservation data
- Incident Date
- 2025-10-14
- Data Types Exposed
- Names
- Email addresses
- Phone numbers
- Reservation details
- Operational Impact
- The compromised application was taken offline after the intrusion was discovered. The number of affected individuals is unclear.
- Ransom Or Extortion
- No ransom or extortion activity was reported. BWH Hotels expressed concern that attackers may use the stolen data for scams or phishing.
- Claim Status
- confirmed