'Convincing' scam email used real booking number, check-in dates

Multiple Tasmanian hotels have been swept up in a data breach involving third-party booking provider RMS.

Guests are being warned to delete suspicious messages, and not click on any links.

RMS is investigating the breach, and says credit card and payment details have not been accessed.

"Thank you for booking Wrest Point Casino. We look forward to welcoming you," it states.

It then lists a reservation summary with a guest's actual booking number, room type and correct check-in and check-out dates.

The email warns that the credit card used to book the room has been blocked by the issuing bank and asks the user to hit a button to update and verify card details to avoid the reservation being cancelled.

But the email was not sent by Wrest Point or its booking software provider, RMS.

The Hobart casino is one of many hotels across Tasmania and the rest of the country caught up in a phishing scam after guest names, contact details and booking information were stolen in a hack of the booking provider.

RMS has advised messages have also been sent via text and WhatsApp.

RMS chief executive Adam Seskis apologised in a statement and noted scams were becoming "increasingly sophisticated".

He said credit card and other payment details had not been accessed in the hack.

"We understand that incidents like this are unsettling for our customers and their guests, and we regret any inconvenience caused."

He urged anyone who received suspicious communication not to click on any link, delete the message, and not forward it to anyone else.

He said if someone followed a link, they should run antivirus software and change passwords.

If a customer inadvertently handed over payment details, they should immediately contact their financial institution.

The Australian booking management company is used by several Tasmanian accommodation providers, including Federal Group, which operates Wrest Point Casino and Country Club.

Other affected chains include ALH Hotels, which run Nightcap and Nightelier accommodation, and Discovery Parks, which hosts a resort at Cradle Mountain.

Major holiday park operators interstate such as BIG4, Reflections and G'day Parks are also understood to have been impacted.

RMS's booking system is used by more than 6,000 hotels, holiday parks and serviced apartments worldwide, according to its website.

Many providers, including Wrest Point, have emailed guests, alerting them to the scam and detailing how it would make genuine contact.

In 2021, Federal Group was caught up in a cyber attack that impacted its pokies machines and hotel bookings system for more than a week.

Earlier this year, major online travel website Booking.com was swept up in a data breach, prompting concerns about the protection of travellers' data.

At the time, the company said information accessed may have included "booking details, names, emails, addresses, phone numbers, and anything that you may have shared with the property".

Cybersecurity expert and University of Tasmania Adjunct Professor Joel Scanlan said nowadays breaches occurred in "basically all areas", with travel just one example.

He said it wasn't uncommon for hackers to target third-party systems, but that didn't make them unsafe.

"If we're considering a hotel chain, for example, if they build their own booking system, they've got to put a lot of resources into that," Dr Scanlan said.

"If they use a third-party provider, they put less resources in, but they're going to get a product that has far more resources than they could afford [themselves].

Dr Scanlan said the downside was that "we're sort of placing our risk somewhere else, and it's a risk that we're not then fully in control of".

"It does mean that a bad day could actually look a bit worse, because multiple organisations are affected," he said.

"But we're hoping that through the benefit of scale of using a third-party service, we've got a more secure system in the first place and we're less likely to have that data breach."

Dr Scanlan said when data was involved in a cybersecurity incident, it was important to confirm exactly what was accessed.

"If your email address has been stolen, it's probably actually something that's in the public domain anyway … whereas if it's accounts that are being stolen that's got things like passwords in it, we then need to think 'where else have I used that password?'."

But he said even small captures could be used to create more personalised scams.

"It's just a case of us being aware of what data of ours is out there," he said.

"Those phishing emails and things can then be much more targeted at particular groups or phrased in certain ways based on the information that they cobble together."