Official Statement: Phishing Messages Using Hotel Booking Details
In brief. Following reports of fraudulent messages that used real hotel booking details, Exely launched an immediate investigation. We found no security vulnerabilities or incidents in Exely systems that contributed to or enabled the incident. Guest payment details were not affected. The incident was traced to a vulnerability in a third-party provider’s extranet; the provider has since closed it. Exely continues to conduct regular independent security audits, vulnerability assessments, and software updates, while reviewing additional safeguards to further protect guest data.
Guests at several hotels that use Exely reported receiving fraudulent WhatsApp messages that appeared to come from their hotels. The messages included accurate booking details and asked guests to follow suspicious links and provide personal or payment information.
As soon as Exely received reports from affected hotels, Exely launched an internal investigation to determine how the reservation data could have been accessed. We also informed customer hotels about the incident and provided recommendations to help them warn guests about possible phishing messages while the investigation was ongoing.
Our investigation found no security vulnerabilities or incidents in Exely systems that contributed to or could have enabled the incident.
A third-party channel manager provider used by the affected hotels, whose system is integrated with Exely Booking Engine, has confirmed that the incident originated from a security vulnerability in its extranet.
The affected provider reported that the first identified test request occurred on 18 October 2026 at 10:06 CEST, and the last retrieval occurred on 20 October 2026 at 14:35 CEST. The exposed data could include: guest names and booking details, email addresses and telephone numbers, where available. Payment data was not affected.
The provider has confirmed that it has closed the identified vulnerability and cut off the path through which data was being retrieved, and introduced additional checks to detect suspicious automated access. On 27 October 2026, Exely received the provider’s preliminary investigation results and lists of affected bookings. We have notified the affected hotels individually and continue to support them in warning guests about phishing messages. If you have not received a separate notification on 27 October, your property is not on the provider’s list.
We strongly recommend that hotels inform their guests about possible fraudulent emails or WhatsApp messages and advise them to treat unexpected messages concerning their reservations with caution.
For guests’ personal data processed through Exely, hotels act as Data Controllers and Exely acts as a Data Processor.
We are handling the incident in accordance with applicable data protection laws and our contractual obligations. The third-party provider involved has confirmed that it notified the relevant competent authorities in its country.
In our capacity as Data Processor, we notified affected hotels without undue delay. Exely continues to cooperate with affected hotels and provide the information they need to assess and meet their own compliance obligations. Each affected hotel, as Data Controller, should assess its own notification obligations under applicable law.
Exely regularly works with independent security firms to conduct security audits and vulnerability assessments. We also keep our software and security components up to date to address newly identified risks and maintain protection of our systems.
Following this incident, we are evaluating additional data minimisation measures for guest data shared with external systems, as well as stricter role-based access within the Exely Extranet, as part of our ongoing security roadmap.
If we decide to introduce any of them, we will inform our customers accordingly.
For questions or further information about this incident, please contact us at support@exely.com.
The Exely Security Team