Short answer
DIRS21 published a security notice on 21 October 2026 saying unknown third parties retrieved reservation data from its online booking system. It blocked the affected endpoint within about 16 minutes of identifying it and believes the access was AI-supported. Only some of its hotel customers are affected.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | DIRS21 |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Hospitality software |
| Country | Germany |
| Detected | 2026-10-21 |
| Disclosed | 2026-10-21 |
| People or records affected | Guests of some hotels using DIRS21 (number not given) |
What data was exposed
- Reservation data from the DIRS21 online booking system (specific fields not listed in the notice)
What happened
DIRS21 provides online booking and channel management software for hotels. On 21 October 2026 it published a security notice titled “Unbefugter Abruf von Reservierungsdaten”, meaning unauthorized retrieval of reservation data. The company says unknown third parties pulled reservation data from its online booking system.
According to the notice, DIRS21 identified the affected endpoint at 12:15 and blocked it at 12:31, after which no further retrieval was possible. Its security systems had detected and logged the retrieval. DIRS21 says it believes, on current knowledge, that the access was AI-supported.
Who is affected
Only some of the hotels using DIRS21 are affected. DIRS21 says it informed those hotels directly and is supporting them, and that other customers were told their operations are not affected. The notice gives no number of hotels or guests and does not name the data fields retrieved. Because the hotels are responsible for informing their guests, you may hear about it from a hotel first.
What DIRS21 says it did
The company blocked the affected endpoint and the IP addresses involved, checked its other interfaces for similar weaknesses and found none, and plans to add extra authentication to protect this retrieval. It preserved access logs so they cannot be altered and filed a criminal complaint.
The phishing angle
Borns IT- und Windows-Blog reported on the notice and linked it to a pattern of booking-themed phishing. A reader there claims DIRS21 data is being used in WhatsApp messages. DIRS21 has not confirmed that, and the blog says it found no public statement from a second platform it checked. We treat the claim as unverified.
Even so, DIRS21’s own advice is practical. Check the sender address for subtle differences, do not click links or open attachments, log in only through the official address, and tell your hotel if a message seems wrong. Our guides on travel and holiday booking scams and phishing messages show what these messages look like.
What to do if you booked a hotel recently
If a hotel told you that your reservation was affected, expect messages that quote your real stay. Verify any payment request by phoning the hotel on a number you found yourself. If you entered card details on a link, call your bank at once. What to do after a data breach lists the follow-up steps.
What is still unknown
The scope, the affected hotels and the identity of the attackers are not public. A similar case at another vendor is covered in our vioma CST7 report, and more incidents are in the breach tracker.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Messages on WhatsApp, email or SMS that quote a real reservation and ask you to confirm payment or card details.
- Lookalike sender addresses, for example dirs-21.de in place of dirs21.de.
- Fake hotel messages about a failed payment, a deposit or an urgent change to your booking.
- Calls to the hotel front desk from people pretending to be guests with a payment problem.
What to do if you are affected
- 01If a message about a hotel stay asks for card data or a transfer, contact the hotel using details you looked up yourself before doing anything.
- 02Check the sender address for small differences and never click links or open attachments in unexpected booking messages.
- 03If you already clicked or entered data, disconnect the device from the network, change passwords from a safe device and tell your bank so it can block the card.
- 04Hotels should train staff to spot phishing and warn guests who raise unusual payment requests.
- 05Log in to booking services only through the official address or a saved bookmark.
Frequently asked questions
Which data did the attackers retrieve from DIRS21?
The notice speaks of reservation data and does not list individual fields. Treat name, stay dates and contact details as possibly exposed if your hotel was affected.
Is every DIRS21 hotel affected?
No. DIRS21 says only some hotels are affected, that it contacted them directly and that other customers were told their operations are not affected.
Was the access really done with AI?
DIRS21 says it believes the access was AI-supported, based on its current knowledge. This is the company's assessment and has not been independently confirmed.
Has DIRS21 reported the incident?
DIRS21 says it preserved access logs in a tamper-proof way and filed a criminal complaint. It says affected hotels must notify their guests.
Are phishing messages already being sent?
A reader comment on Borns IT- und Windows-Blog claims booking data is used in WhatsApp phishing. DIRS21 does not confirm this, so treat it as unverified.
Sources
- Unbefugter Abruf von Reservierungsdaten (Sicherheitshinweis vom 21.10.2026), DIRS21, 2026-10-21
- Datenleck bei notebooksbilliger.de und Phishing bei DIRS21 und topcamping.de, Borns IT- und Windows-Blog, 2026-11-03
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.