NightsBridge has told clients and customers that its systems were breached, adding another entry to a year of South African accommodation platform incidents. The data taken is modest on paper and close to ideal for fraud in practice.

What happened

NightsBridge, which consolidates accommodation technology for South African establishments, said a review found that an AI agent had compromised a back-office summary list. Names, email addresses, contact details, booking reference numbers and client company information were exposed.

The managing director told MyBroadband that no guest or payment information was in the accessed list, but that the booking dates and reference numbers alone were enough to build a WhatsApp message that looks convincing. Guests are already reporting reservation hijacking attempts, and the pattern lines up with breaches at Booking.com and with earlier incidents at LekkeSlaap and Hospitality Technology International.

The common thread is not a sophisticated exploit. It is leaked metadata: a real reference number, a real arrival date and a real property name, used to ask a guest to pay a deposit into a new account.

Who is affected

• Guesthouses, lodges and B&Bs using NightsBridge, Booking.com, LekkeSlaap or HTI as a booking channel
• Guests with December bookings, who are the direct targets of the payment requests
• Establishments whose staff handle booking changes over WhatsApp or email
• Any property that receives guest payment data and therefore carries POPIA obligations for it

What to do now

Tell every guest with an upcoming booking that you will never change banking details by WhatsApp or email, and that any such message must be verified by phoning the property on a number from its own website.

• Publish a short fraud warning on the property website and in the booking confirmation mail, in plain language
• Have staff call guests directly on any bank-detail change, using the number on the original booking, not a number supplied in the message
• Review who at the property can export booking or guest lists, and remove access that is not needed day to day
• Check whether your booking platform notified you as a responsible party, and document the notification under POPIA section 22
• Warn December guests in advance, before the fraudster's message arrives

What this means for South African businesses

Hospitality is a soft target because the fraud does not need to touch the property's bank account at all: the guest pays the attacker and the property absorbs the complaint, the refund and the reputation damage. For a small lodge with thin December margins, a handful of hijacked deposits is a material loss.

The Information Regulator has already shown it treats supplier-side exposure as the responsible party's problem, so a guesthouse cannot outsource this to its booking platform. My read is that most properties using these platforms have not notified anyone, because they do not yet realise the breach reached their guest data.

Source

Reporting and the NightsBridge statement are covered in MyBroadband's article on attacks on the South African hospitality industry.

Also on the blog

• ScreenConnect abuse: rogue clients pushed to 286 MSP-managed endpoints
• ASUS router CVE-2026-88710: CVSS 8.7 root access from the local network

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.