Short answer
Vioma, which runs the CST7 reservation system for hotels, says unusual automated requests on 2 November 2026 led to booking data being retrieved without authorization. The company closed the gap the same evening. It says credit card data and passkey logins were not affected and rates the phishing risk for the data as elevated.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | vioma |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Hospitality software |
| Country | Germany |
| Detected | 2026-11-02 |
| Disclosed | 2026-11-03 |
| People or records affected | Guests of hotels that received vioma's notice of 2 November (number not given) |
What data was exposed
- Booking ID, booking time, booking channel and booking amount
- Guest first and last name
- Stay period and booked service
- Email address, phone number and postal address
- Other booking fields such as free-text notes (cannot be ruled out)
What happened
Vioma is a software company whose CST7 system manages reservations for hotels and tourism businesses. In a notice updated on 6 November 2026, it says that on 2 November unusual automated requests triggered password-reset emails that users had not asked for. Booking data was then retrieved without authorization from affected CST7 accounts.
The company’s timeline starts at 16:43 that day, when the first unrequested reset emails went out. By 18:54 it had closed the security gap, and by 19:35 it says the root cause was fixed. Hotels got a first email at 22:25. Borns IT- und Windows-Blog picked the notice up after a reader comment.
What data was taken
Vioma lists the likely retrieved data as booking ID, name, stay period, booking amount and time, booking channel, email address, phone number, postal address and booked service. It cannot rule out other fields, such as free-text notes, because retrievals of booking lists were not logged one by one.
It says credit card data, which the affected interface could not reach, was not involved. Passwords were not directly affected, and neither were users who sign in only with a passkey. Vioma rates the risk for the retrieved data as elevated.
Who is responsible for telling guests
Vioma acts as a processor for its hotel customers. It says the hotels, as controllers, decide on reporting to the data protection authority under Article 33 of the GDPR and on notifying guests under Article 34. Guests may therefore hear about this from a hotel rather than from vioma. The company filed a criminal complaint with the Baden-Wuerttemberg LKA on 5 November.
Why booking data is a scam tool
The blog describes a run of similar cases at booking platforms, where stolen reservation details feed messages that quote a real booking and push the guest to hand over card data. That is not confirmed for this incident, and vioma has not reported any such messages. Still, a message with your real arrival date and amount looks far more believable than a generic one. Our guides on travel and holiday booking scams and phishing messages explain how to check these, and what to do after a data breach covers the basics.
What is still unknown
Vioma has not said how many hotels or guests are affected, which hotels they are, or who carried out the retrieval. Related reservation-system incidents are collected in our breach tracker, including the DIRS21 booking data access.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- WhatsApp, SMS or email messages that quote your real booking and ask you to confirm or re-enter card details.
- Fake messages claiming to be from the hotel about a payment problem, a deposit or a changed reservation.
- Phone calls that cite your arrival date and amount to sound legitimate.
- Lookalike booking or payment pages that copy the hotel's or booking site's branding.
What to do if you are affected
- 01Treat any message about your stay that asks for card details, a transfer or a link click as suspect, even if it contains correct booking data.
- 02Contact the hotel using a phone number or address you find yourself, not one given in the message.
- 03If you hold a CST7 account as a hotel user, change your password or switch to passkey sign-in, and review user accounts.
- 04If you already entered card details, call your bank to block the card and watch your statements.
- 05Hotels should check their duties under GDPR Articles 33 and 34, since vioma says hotels decide on reporting and guest notification.
Frequently asked questions
Was my credit card data exposed in the vioma incident?
Vioma says credit card data was not reachable through the affected interface. Booking details, contact data and the amount were, so card-themed phishing is still a risk.
How do I know if my hotel was affected?
Vioma says only hotels that received its email of 2 November 2026 are affected. Ask your hotel directly if you are unsure.
Which bookings are involved?
Vioma says mainly bookings with an arrival date from 1 November 2026. It cannot give the exact scope because list views were not logged individually.
Were passwords stolen?
Vioma says passwords were not directly affected and that users who sign in only with a passkey were not affected. It still recommends a password change or passkeys.
Has the incident been reported to the police?
Vioma says it filed a criminal complaint with the Baden-Wuerttemberg state criminal police office (LKA) on 5 November.
Sources
- Wichtige Information zu einem aktuellen Sicherheitsvorfall, vioma, 2026-11-06
- Cybervorfall bei vioma (Hotellerie / Tourismus) mit Abfluss von Buchungsdaten, Borns IT- und Windows-Blog, 2026-11-05
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.