Best Western Hotels Warns Guest Reservation Data May Have Been Leaked in Violation

BWH Hotels confirmed a cyberattack on April 22, 2026, stealing guests’ names, emails, phone numbers, postal addresses and reservation details.
Attackers exploited a flaw in a web application containing customers’ booking data, but payment and banking details were not affected.
The company took the app offline, hired external experts and urged customers to remain vigilant about suspicious communications.

BWH Hotels, a leading global hotel chain operating thousands of hotels around the world, has confirmed that it suffered a cyberattack and lost sensitive customer data.

In a data breach notification recently sent to affected individuals, Bill Ryan, the company’s chief technology officer (CTO), said the attack was spotted on April 22, 2026. The crooks stole sensitive data, including the names, email addresses, phone numbers, and postal addresses, of an as-yet unspecified number of people.

Reservation details, including reservation numbers, stay dates and special requests, were also retrieved.

A warning to users

The data was generated between October 14, 2025 and April 22, 2026, but it is unclear how long the scammers were hiding in BWH Hotels’ systems.

The anonymous attackers apparently found a flaw in a web application that hosted some customer reservation data, but that information did not include payment or banking details.

“As soon as we discovered the incident, we immediately took the app offline and revoked the unauthorized access,” Ryan said. The register in a written statement.

“We have engaged leading external cybersecurity experts to support our incident response efforts and help us further strengthen existing protection measures.”

Ryan also urged customers to be “extremely vigilant” when viewing unexpected or suspicious communications regarding hotel stays.

“If you receive a suspicious communication such as an unexpected email, SMS, WhatsApp message or phone call requesting payment, codes, credentials or ‘verification’, even if they refer to a BWH Hotels property or an upcoming booking, do not engage. Go directly to the sites rather than clicking on links,” he stressed.

BWH Hotels is a global hotel group that serves as the parent organization for Best Western Hotels & Resorts, WorldHotels and SureStay Hotels. It operates approximately 4,300 hotels in more than 100 countries and earns more than $8.5 billion annually.