Unauthorized access to a BWH Hotels (Best Western, WorldHotels, Sure Hotels) guest-reservation web application from 2025-10-14 until its discovery on 2026-04-22.
Coverage
1
first 2026-05-13 → last 2026-10-21
Latest activity
2026-05-13
BWH Hotels says attackers had access to a guest-reservation web application from October 2025 until April 2026
Peak priority
routine
1 routine
Targets
retail
sectors: retail
Sources cited
2
2 hosts
Defender insights
What each entry about BWH Hotels reservation breach tells a defender to do, newest first.
1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)
CollectionData from Information Repositories
Collection TA0009
T1213Data from Information Repositories×1
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
BWH Hotels, which operates more than 4,000 hotels including WorldHotels, Best Western Hotels & Resorts and Sure Hotels, told affected guests that it discovered the intrusion on 2026-04-22 and that the attackers had had access since 2025-10-14 to a web application holding guest names, email addresses, phone numbers and reservation details; payment and other financial information was not stored there, and how many guests are affected is unclear (SecurityWeek, 2026-05-12). The Register says the affected data goes back to 2025-10-14 and also includes home addresses, reservation numbers, dates of stay and special requests, that BWH took the application offline and revoked the unauthorised access, and that BWH has notified the appropriate regulatory agencies (The Register, 2026-05-11). No source states how the attackers got in, and no known cybercrime group has claimed the attack (SecurityWeek, 2026-05-12).
the intrusion was discovered on April 22, and an investigation showed that threat actors had access since October 14, 2025.
BWH Hotels owns the WorldHotels, Best Western Hotels & Resorts and Sure Hotels brands, and the exposed fields are names, email addresses, telephone numbers, home addresses and reservation details, with no payment or bank details involved (The Register, 2026-05-11). SecurityWeek, quoting the guest emails, says the attackers had access from 2025-10-14 until the intrusion was discovered on 2026-04-22, while The Register says the affected data goes back to 2025-10-14; neither source discloses how the attackers got in or how many guests are affected (SecurityWeek, 2026-05-12), and BWH says only that it notified the appropriate regulatory agencies (The Register, 2026-05-11).
incident13 May 05:00Zsingle-source · victim disclosureOpen finding →