Best Western Group Security Breach Email

Intoodeep

As a regular user of BWH, received this Email last Friday (8th)

BWH® Hotels, the parent company for WorldHotels™, Best Western® Hotels & Resorts, and Sure Hotels®, takes the privacy and security of our guests’ personal information very seriously. We are writing to let you know that on April 22, 2026, we identified unauthorized activity in one of our web applications that houses certain guest reservation data.

We have learned that certain guests’ names, email addresses, telephone numbers, and/or home addresses, along with other reservation details (e.g., reservation numbers, dates of stay, and any special requests) for reservations in our system were accessed by an unauthorized third‑party between October 14, 2025 and April 22, 2026, including yours. Importantly, payment and other financial information was not stored in the affected system and therefore was not accessed.

Upon discovering the incident, we immediately took the application offline and revoked the unauthorized access. We have engaged leading external cybersecurity experts to support our incident response efforts and to assist with the further strengthening of existing safeguards. We advise guests to be extra vigilant when viewing any unexpected or suspicious communications about hotel stays. If you receive a suspicious communication such as an unexpected email, text, WhatsApp message, or telephone call that asks for payment, codes, logins, or “verification,” even if they reference a BWH Hotels property or an upcoming reservation, do not engage. Navigate to sites directly rather than clicking links.

As part of protecting your personal information and to prevent payments to fraudulent parties, here are some precautions you can take:

• Stay alert for suspicious sender addresses, urgent or unexpected unsolicited requests, and strange links, especially any unexpected request for payment or personal information. Treat any suspicious request with caution. If you have a question regarding a suspicious request, please contact our customer service team.
• Scammers may create webpages that closely resemble legitimate hotel booking pages. Always review the web address before entering payment details. If a page looks unexpected or unfamiliar, stop and verify it with our customer service team before proceeding. If you entered or shared any payment (credit card) information in response to a scam, please immediately report it to your financial institution and follow security steps they recommend.
• If you have any questions, please contact BWH Hotels' data protection office at dpo@bwh.com.
• We appreciate your understanding and sincerely apologize for any inconvenience or concern this incident may cause you.
• Sincerely,
• Bill Ryan
  Chief Technology Officer
• BWH Hotels

flaneurs_lobster

Notice that they don't say how many of their "guests" details have been "accessed" - bet it's shedloads.

TBH, these kind of hacks are occurring weekly. Unless they've specifically accessed payment card details I wouldn't be too concerned.

The precautions suggested in the email should already be taken by anyone who engages with any business on the internet.