Cyber-Crime
BWH Hotels guests warned after reservation data checks out with cybercrooks
Customers urged to keep an eye out for phisherfolk
BWH Hotels is informing customers about a third-party data breach that gave cybercriminals access to six months' worth of data.
The notification email stated that BWH Hotels, which owns the WorldHotels, Best Western Hotels & Resorts, and Sure Hotels brands, identified the intrusion on April 22, but the affected data goes back to October 14, 2025.
BWH Hotels CTO Bill Ryan, who penned the notification email, said names, email addresses, telephone numbers, and/or home addresses belonging to "certain guests" were accessed by an unauthorized third party.
REG AD
The intruders also accessed reservation details, such as reservation numbers, dates of stay, and any special requests.
REG AD
It confirmed that the attack targeted one of its "web applications that houses certain guest reservation data." No payment or bank details were involved.
The Register asked BWH Hotels whether the intrusion began in October and went undetected until April, or whether a later breach exposed data dating back to October.
We also asked if this was related to information we were sent in March about BWH Hotel customer booking data being stolen and used for phishing campaigns. At the time, the company neither confirmed nor denied the information seen by The Register.
BWH Hotels did not immediately respond to our request for comment on Monday.
"Upon discovering the incident, we immediately took the application offline and revoked the unauthorized access," said Ryan. "We have engaged leading external cybersecurity experts to support our incident response efforts and to assist with the further strengthening of existing safeguards."
"We advise guests to be extra vigilant when viewing any unexpected or suspicious communications about hotel stays. If you receive a suspicious communication such as an unexpected email, text, WhatsApp message, or telephone call that asks for payment, codes, logins, or 'verification,' even if they reference a BWH Hotels property or an upcoming reservation, do not engage. Navigate to sites directly rather than clicking links." ®