Overview
- Kempinski says an unauthorized party misused an access key from a technical third‑party to take guest reservation records from its systems.
- The hotel chain says names, phone numbers, emails and booking details may have been exposed while payment card data appears not to be affected and passport or visa data cannot be ruled out.
- Restaurant Borchardt reported its external reservation service was attacked but says its internal booking system was not breached and is still being assessed for any data loss.
- Guests have received targeted phishing messages that include real booking information and ask for payments or card re‑entry, and venues warn customers to ignore links and use only official contact channels.
- Both organisations have blocked the compromised access, notified data‑protection authorities, hired independent cybersecurity investigators, and the incidents underscore how third‑party providers widen the risk to guest privacy under EU rules.