Kempinski Guest Data Accessed Through Compromised Third‑Party Key, Borchardt Booking System Hit

Overview

• Kempinski told guests Wednesday that an access key belonging to a technical third‑party was misused and that names, phone numbers, email addresses and reservation details may have been taken.
• The hotel group says payment card data were not stolen but cannot rule out that passport or visa numbers were affected, and the exact timing and number of affected guests remain unclear.
• Unknown actors have used real booking numbers and stay dates to send convincing emails, SMS and WhatsApp messages asking guests to confirm payments or re‑enter card details.
• Kempinski has disabled the compromised credential, hired an independent cybersecurity specialist and notified data protection authorities while Restaurant Borchardt says an external reservation system it uses was attacked but its internal system was not affected.
• The incidents highlight a wider supply‑chain risk for hotels that use third‑party booking platforms and point to short‑term harms for guests such as fraud losses, identity exposure and the need to block cards and report suspicious requests to banks and police.