Updated 31 October 2026
Contact Booking.com and your IT provider now, clean the computers involved, then change all extranet and mail passwords and check your bank details. Warn guests not to pay through any new link.
We don't provide incident response. This guide collects advice published by hotel associations, and doesn't replace your IT provider or Booking.com. Follow their instructions where they differ.
Do this first
- Contact Booking.com and your IT providerReach your account manager, and report that messages are being sent in your name. Your hotel association may be able to help too.
- Check the computersMany takeovers start with malware on a staff PC. If it's still there, new passwords can be captured too, so have the devices checked and cleaned.
- Change every passwordAll extranet accounts, plus the mailboxes linked to them.
- Switch on two-factor authenticationOn every extranet account.
- Check your bank detailsLook at payout details. Reported cases include details changed to a foreign account.
- Check contact details and usersLook for phone numbers, addresses or users you don't recognise.
- Check logins and messagesLook for unexplained logins and changed message logs, and save what you find.
Protect your guests
- Warn guests never to pay through a new link or to a new account
- Tell them how you really take payments
- Ask Booking.com whether links in messages can be disabled for you
- After consulting Booking.com, review your cancellation and prepayment terms
Reporting
If guest data was accessed, this may be a data breach under the GDPR. A report to the supervisory authority is due without undue delay, and within 72 hours where feasible. Those deadlines are taken seriously: in 2021, the Dutch authority fined Booking.com €475,000 for reporting a breach late. This isn't legal advice, so get advice on your own situation. It's also worth asking the police whether to file a report.
Once it's calm
Look at why it was possible, so it doesn't happen again. Personal logins instead of a shared one, two-factor authentication on every account, and staff who are wary of guest mails with attachments or links will do a lot.
Our eight questions for hotels are a good place to start.
Questions from hotels
How do criminals get into a Booking.com account?
Many takeovers reportedly start with malware on a staff computer that captures the extranet login, often sent as a mail that looks like a guest with a question or a complaint.
Do we have to report it to the data protection authority?
Possibly. If personal data was exposed, the GDPR can require a report within 72 hours where feasible. In the Netherlands, that goes to the Autoriteit Persoonsgegevens. This isn't legal advice, so check your situation.
Can 0Confusion handle this for us?
No, we don't provide incident response. Contact your IT provider and your booking platform right away. Once things are calm, we can help you look at access and settings in a review.
