Scammers target major holiday parks across Australia in cybersecurity breach

BIG4 and other major holiday park operators are warning guests about fraudulent messages following a breach involving a third-party booking platform.

Scammers are using booking details to target travellers with fake payment requests.

Travellers are being urged not to click suspicious links or share payment details.

Australian travellers are being warned their personal information may have been exposed following a cybersecurity breach involving an accommodation software company.

Major holiday park operators, including Reflections, BIG4 and G'day Parks, are understood to have been affected through Australian booking management software provider RMS Cloud.

The company provides cloud-based property management and booking systems to more than 6,000 hotels, holiday parks and serviced apartments around the world, according to its website.

The ABC has contacted the company for comment.

One of Australia's biggest holiday parks, BIG4, said guests had been targeted by scammers following a breach of a third-party booking platform.

"We've been made aware of a breach of a third-party platform which is used by some of the parks within our network, as well as a number of other accommodation providers and groups. This has resulted in some guests receiving fraudulent messages asking for credit card or payment details," a Big4 spokeswoman said.

"While RMS is undertaking investigations, we have been in touch with parks who may have been affected and provided them with preliminary information and advice for their customers which includes not clicking on suspicious links or providing payment information."

Reflections Holidays, which runs caravan holiday parks across NSW, has sent guests messages warning them of the scam.

"Our booking system provider RMS has made us aware that there are phishing emails being sent to future Reflections Holidays guests from RMS, claiming booking payments have failed," the text message reads.

"Please don't click links or share payment details."

Cherie Midson, who manages a holiday park in Victoria's East Gippsland, said concerned guests began contacting the business after the messages started circulating.

"The messages started going out last night and the calls started coming in today," Ms Midson said.

"Some of the details, like names and dates of stay, are correct."

Ms Midson said she had reported the matter to the federal government's Scamwatch site.

"It's very worrying. Our details are being used, which reflects on us as a business," she said.

"We're concerned our guests could fall victim to the scam, and if they do, our business will be associated with that. That's a real worry for us."

Summerstar Tourist Parks, which operates dozens of caravan parks across Western Australia, has also warned guests of the "cybersecurity breach" on social media.

"We have recently been notified of a cybersecurity breach from RMS, our external booking system provider," the post says.

"Fraudulent emails and WhatsApp messages that appear to be from Summerstar Tourist Parks are circulating asking you to click a link to verify your booking details."

It is not the first cybersecurity breach to target travellers.

Earlier this year, the ABC revealed Booking.com guests had been targeted in a phishing scam involving fake hotel messages on WhatsApp and emails, with their personal details.

Cybersecurity expert Professor Daswin de Silva said travel data was "highly valuable" because it contained detailed information about a traveller's identify.

"There's an assumption that people who travel have financial capacity, which makes them appealing targets for cybercriminals," he said.

Scamwatch, the Australian Competition and Consumer Commission's scam reporting service, said it received more than 13,000 reports of phishing scams in the first three months of 2026.