NightsBridge, a South African company that connects guesthouses, lodges and hotels to the booking channels that sell their rooms, told clients on 2 November 2026 that its platform had been breached. Its managing director says the company believes an AI agent brute-forced its way in through a vulnerability in the codebase.

What happened

NightsBridge detected unusual activity at about 20h55 on 2 November and confirmed it as a data breach roughly half an hour later. What was taken was a back-office summary of channel partner bookings rather than the main reservation system: booking dates, booking IDs, property names and suburbs, owner contact details, guest surnames and email addresses, deposit and total amounts, and payment results.

No card data or identity documents were involved, but the combination of a real booking number, real dates and a real property name is enough material to build a believable message. NightsBridge says scammers began using it and that it has warned partners and clients.

Who is affected

• Any property that uses NightsBridge to distribute rooms, including small guesthouses and B&Bs with no in-house IT.
• Any guest holding a future booking at one of those properties, whose surname and email address may now be in criminal hands.
• Front desk and reservations staff, who are the people a booking-change or payment request would be aimed at.

What to do now

Treat every booking change or payment request that arrives by WhatsApp or email as unverified until you have called the guest back on a number you already hold.

• Warn front desk staff today, in writing, that a message quoting a correct booking number and date is not proof of anything.
• Confirm any cancellation, refund or bank detail change against the reservation inside your property management system, never against the message.
• If your property holds guest personal information as a responsible party, POPIA section 22 requires you to notify the Information Regulator and affected guests as soon as reasonably possible once you know their data was compromised.
• Turn on multi-factor authentication for every account that can log in to the booking platform, and remove logins for staff who have left.

What this means for South African businesses

Hospitality is where this lands hardest, because front desks spend the day answering WhatsApp messages and a spoof that quotes the right booking number reads as routine. The wider lesson is about supplier risk: a small property can hold its own systems together and still lose guest data because a platform it never audits was breached instead. If you resell or integrate with a booking, payments or PMS provider, that provider's incident is your POPIA incident. The reporting is from MyBroadband, which spoke to NightsBridge directly.

Also on the blog

• SonicWall CVE-2026-19868: SAML bypass skips MFA on SSL-VPN logins and is already exploited
• D-Link DGS-3130: unpatched DDP flaws in SMB switches, no firmware fix

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.