Short answer
Turkey's data protection authority (KVKK) published a notice on 21 October 2026 saying a threat actor used social engineering to reach an employee's network account at Choice Hotels International on 5 and 6 June 2026. The notice says 9,550 customers were affected. KVKK says its review is ongoing.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Choice Hotels International, Inc. |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by authorities |
| Sector | Hospitality |
| Country | Turkey (notice filed with KVKK; company is US-based) |
| Detected | 2026-06-05 |
| Disclosed | 2026-10-21 |
| People or records affected | 9,550 customers, per the KVKK notice |
What data was exposed
- Names and surnames
- Contact details
- Past hotel stay details (for some people)
What happened
Choice Hotels International, the US-based hotel franchisor, appears in a data breach notice published by Turkey’s KVKK on 21 October 2026. The notice describes a social engineering attack: a threat actor tricked their way into an employee’s network account. A security monitoring alert detected the activity.
Timeline
Per the notice, the unauthorized access began on 5 June 2026, was detected the same day and ended on 6 June 2026. The public notice came more than four months later. The KVKK Board ordered it on 21 October under decision 2026/2288 and says its review of the incident continues.
What was taken
The notice counts 9,550 affected customers. The data is names and contact details. For some people it also includes details of past hotel stays. The notice does not name the specific contact fields, the brands involved or the countries where customers live.
Why a Turkish regulator is involved
Turkish law requires a company to report a breach affecting people in Turkey to KVKK. The notice does not say how many of the 9,550 customers are in Turkey, so we cannot say how many people elsewhere are covered. A Memurlar.Net summary lists the notice among the 10 KVKK released that day.
What is still unknown
The notice does not describe what Choice Hotels did in response, and we found no public statement from the company. We do not know which systems the employee account could reach, whether the data has been leaked, or whether customers outside Turkey have been told.
What this means for travellers
Travel scams are easier to write when the sender knows where and when you stayed. A fake message about a damaged room, an overcharge or a refund can feel real. Real hotels rarely ask for full card details by text or email. See our guides on phishing messages and urgent payment scams, and use the data breach checklist if you booked with a Choice brand. More incidents are on the breaches index.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake booking, cancellation or refund emails and texts that mention a real hotel stay
- Phishing messages claiming to be from a hotel brand and asking you to 'verify' card details
- Calls from someone who knows your name and a past stay and asks for a deposit or card number
- Fake loyalty-points or discount offers sent to the contact details you gave when booking
What to do if you are affected
- 01Be wary of any message about a booking or refund you did not expect. Check the booking directly on the hotel or brand's official website or app.
- 02Never give card numbers, codes or passwords to a caller, even if they cite a real past stay.
- 03Use your bank's official app to review recent card activity and report anything you do not recognise.
- 04If you booked through a Choice Hotels brand, use a unique password for your loyalty account and turn on two-factor authentication where offered.
- 05Complain to KVKK if you are in Turkey and think your data was mishandled (Alo 198).
Frequently asked questions
How many Choice Hotels customers were affected?
The KVKK notice says 9,550. It does not say how many of them are in Turkey or in other countries.
How did the breach happen?
According to the notice, a threat actor used social engineering to gain unauthorized access to an employee's network account. A security monitoring alert detected it.
When did it happen?
The notice gives 5 June 2026 as the start and detection date and 6 June 2026 as the end. It was made public on 21 October 2026.
Were payment cards exposed?
Card data is not in the list of affected data in the KVKK notice, which names contact details and, for some people, past stay details.
Did Choice Hotels comment?
We found no public statement from Choice Hotels on this incident and the KVKK notice does not quote one.
Sources
- Kamuoyu Duyurusu (Veri İhlali Bildirimi): Choice Hotels International, Inc. (Public Notice, Data Breach Notification: Choice Hotels International), KVKK (Turkish Personal Data Protection Authority), 2026-10-21
- KVKK 10 veri ihlalini duyurdu: Belediye ve üniversite de listede (KVKK announced 10 data breaches: a municipality and a university are on the list), Memurlar.Net via Bundle, 2026-10-22
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.