Stolen booking data: fake WhatsApp messages target ski guests in Tirol
Mathon in the Paznaun valley, part of Ischgl, in January 2016. Photo: KrauS via Wikimedia Commons, CC BY 3.0
Around 1,700 accommodation businesses in at least four Tirol tourism regions may be affected by a theft of booking data, among them Ischgl, Serfaus, Seefeld and Stubai. Guests with a winter booking now get fake WhatsApp messages that look like their hotel. They show the real dates and booking number, and ask for card details through a link.
In short
- Booking data was downloaded between 23:00 on 25 October and 01:15 on 26 October 2026, according to Feratel.
- The data holds name, address, phone, e-mail, travel dates, the booked property, the price and the payment status.
- No card or bank data was taken, Feratel says.
- In Tirol about 1,700 businesses may be affected; in Salzburg 97 hotels; in Styria all tourism boards.
- A real booking never needs a new "validation" through a WhatsApp link.
What happened
Feratel, an Innsbruck company, runs the Deskline booking system that many Austrian tourism boards use. In a statement to its partners, published in full by Borns IT-Blog, the company says its own systems were not broken into. An attacker got the Deskline login of an interface partner through a third-party system, and used it to download bookings.
"The retrieved booking data comprise name, address, phone number, e-mail address, travel dates, booked property, travel price and payment status," the Feratel statement says. It covers bookings with an arrival date in the future, made through selected sales channels. Feratel blocked the access and changed the login data.
The Tirol police reported on Friday 30 October 2026 that unknown persons got into the web application of a software company in the Schwaz district. The access ran from 17 to 28 October 2026. The police did not name the company. As of 2 November 2026, neither the police nor Feratel has said that the two cases are the same.
| Date | Step |
|---|---|
| 17–28 October 2026 | Unauthorised access to a booking application of a company in the Schwaz district (police) |
| 25–26 October 2026 | Booking data downloaded, 23:00 to 01:15 (Feratel) |
| 27–28 October 2026 | First guests report fake WhatsApp messages and e-mails |
| 30 October 2026 | Tirol police report the case |
| 31 October 2026 | Feratel confirms the incident to ORF |
Which regions are affected
In Tirol, Feratel named the tourism boards of Stubai, Serfaus, Seefeld and Ischgl, ORF Tirol reported. About 1,700 businesses there may be affected. From the feedback of the boards, Feratel expects that about one third of them is hit: the ones with future bookings.
| Region | Affected, as reported |
|---|---|
| Tirol | at least 4 tourism boards, about 1,700 businesses potentially |
| Salzburg | 97 hotel businesses in 11 tourism boards |
| Styria | all tourism boards, about 3,000 guests |
| Upper Austria, Vorarlberg, Burgenland | no incidents reported |
The Salzburg figures come from ORF Salzburg. The Styrian figure of 3,000 guests comes from the Kleine Zeitung, as reported by oe24. The Tiroler Tageszeitung wrote on 28 October 2026 of tens of thousands of records in Tirol.
"A large part of the bookings that lie in the future is affected," Klaus Gleirscher, director of the Stubai tourism board, told ORF Tirol. How far into the future, the board does not know.
How the fake messages work
The scammers write as the booked hotel or apartment. The tourism boards' warning, also printed by Borns IT-Blog, says guests are asked to confirm the booking through a link, to enter personal data, or to leave card details. The message carries the real hotel name, dates and booking number, so it looks correct.
A Dutch guest got such a WhatsApp on the evening of Tuesday 27 October 2026, skiinformatie.nl reported. It asked him to "validate" the booking within 24 hours. He entered his card data within half an hour. "It just looked right," he told the site. Friends warned him, and he blocked his card in time.
Who investigates
Reports went to the Austrian data protection authority, ORF Tirol wrote. A complaint is with the police, and Feratel works with outside forensic experts. How many guests and hotels are affected will be "very hard to find out", a police spokesman told the APA news agency, as reported by the Salzburger Nachrichten. As of 2 November 2026, the total damage is not known.
Before you pack your skis
A ski trip starts with the booking, so check it first:
- Do not open links in messages about your booking. A real booking does not need a new validation.
- Call your hotel only on the number from your original confirmation or its official website.
- Never give card or bank details through a link in WhatsApp, SMS or e-mail.
- If you entered card data, call your bank at once to block the card, and report it to the police.
With the booking safe, the next step is the skis. The Pick-A-Ski selector compares this season's skis on your level, terrain and size. For a week of groomed runs and some off-piste in resorts such as Ischgl or Serfaus, start with our top 5 all-mountain skis.
