Inside the BookingTek Database Breach: How 40,285 Hotel Records Leaked

HEROIC researchers tracked the BookingTek data breach back to a database compromise first surfaced on January 3, 2025. The UK-based hospitality booking software provider saw 40,285 customer records exposed, including email addresses and phone numbers belonging to hotel guests and conference attendees who trusted BookingTek's direct-booking platform. The data surfaced on a public forum, giving opportunistic threat actors immediate access to a targeted contact list.

Why This BookingTek Database Leak Is Dangerous

Database breaches involving hospitality platforms create an outsized risk because the exposed contacts are already conditioned to receive booking confirmations, check-in reminders, and travel notifications. Once attackers have that trust signal, phishing messages impersonating BookingTek or partner hotels convert at alarming rates. The combination of real email addresses and real phone numbers also opens the door to SMS smishing campaigns, fraudulent loyalty-point offers, and fake refund scams that appear entirely legitimate to anyone who recently booked through the platform.

What Was Exposed in BookingTek

• Email addresses tied to hotel and conference bookings
• Phone numbers used for reservation contact and confirmations
• Records totaling 40,285 affected individuals
• Data sourced directly from a customer-facing booking database

Why This Matters

Even without passwords in the dataset, the BookingTek leak gives attackers a verified contact list to fuel credential stuffing against hotel loyalty accounts, account takeover attempts on connected travel services, and identity theft through targeted social engineering. Fraudsters frequently combine leaked contact details with data from other breaches to build complete profiles, making invoice fraud and travel-reward theft significantly easier to execute against affected users.

How Database Breaches Work

A database breach typically begins with exposed credentials, unpatched vulnerabilities, or a misconfigured cloud instance that lets an attacker pull entire tables of customer records at once. Unlike targeted phishing, database incidents spill structured data in bulk, which is why a single compromise can affect tens of thousands of users in minutes. Once exfiltrated, the records are packaged for resale, posted to leak forums, or traded on dark web marketplaces where they fuel secondary attacks for years after the original intrusion.

Check If You Are Affected

HEROIC monitors more than 400 billion compromised records across surface web leaks, dark web marketplaces, and underground forums. Run a free scan to confirm whether your email address or phone number appeared in the BookingTek breach or any of the thousands of other incidents tracked in our DarkHive intelligence database.