Real bookings, fake demands: Holiday parks warn guests following RMS security incident

Holiday parks in Australia and New Zealand have issued guest warnings about fraudulent booking messages, as RMS investigates unauthorised access involving some guest contact and reservation information.

Your name is correct. So are your holiday dates and booking confirmation number. Then comes the demand: verify your credit card details or your booking will be cancelled.

Read the latest edition of AccomNews HERE

It is a convincing approach, and one accommodation operators are now warning guests to watch for following a security incident involving property management software provider RMS.

For park teams, the immediate challenge is twofold: helping guests protect themselves while reassuring them about their holiday bookings.

What RMS has confirmed

In its October 28 statement, RMS said it identified unauthorised access to a limited part of its environment on October 26.

The company said current findings indicated that some guest contact and booking information was involved, but credit card and payment details were not. The investigation remains ongoing.

In a message to customers, RMS chief executive Adam Seskis acknowledged the concern and disruption experienced by affected operators and their guests.

“Our team is working around the clock with forensic, cyber and legal specialists to investigate and respond,” Seskis said.

He said the company’s priority was providing clear information and practical guidance, and that it would share confirmed information as the investigation continued.

Seskis also warned that an unknown entity was sending phishing communications impersonating RMS or its clients.

“For travellers, a message quoting your booking details does not make it genuine.”

Australian parks alert guests

Warrnambool City Council issued a public warning on October 28 about fraudulent messages claiming to come from Surfside Holiday Park or Shipwreck Bay Holiday Park.

The council said RMS, the external provider of Surfside Holiday Parks’ booking system, had experienced a data breach.

Its notice warned that messages could contain genuine names, stay dates and booking confirmation numbers, and request credit card details or payment to prevent cancellation.

The council said no credit card or payment details had been accessed as part of the breach. It reassured guests that their bookings remained unchanged and urged anyone who had supplied card details or made a payment to contact their financial institution immediately.

There was another important clarification: an October 27 SMS reminding guests about a December 1 payment deadline was genuine.

Related AccomNews story: Cyber risk: Protecting your accommodation business

That distinction illustrates the difficulty for accommodation businesses. Legitimate payment reminders still need to reach guests, even as operators warn them to be cautious about unexpected requests.

BIG4 has also published guidance, saying RMS is used by approximately one-third of parks in its network. Its warning said the incident involved unauthorised access to guest contact and booking information and extended to accommodation providers outside BIG4.

New Zealand warning describes cancellation threat

In New Zealand, Red Beach TOP 10 Holiday Park emailed guests on October 27 to warn them about fraudulent booking messages.  The email described a fraudulent message titled “Guarantee Alert”, containing the guest’s name, booking dates and confirmation number.

It claimed a credit card security check had been blocked by the guest’s bank and threatened cancellation within 72 hours unless the recipient updated and verified their card details.

According to the park’s warning, the message also claimed no charge would be taken and included a security warning about sharing card information — details designed to make the request appear trustworthy.

Red Beach TOP 10 said it was working with RMS to establish what had happened and whether any of its guests’ information was involved.

The park told guests it did not use WhatsApp, would not ask them to verify or update card details through an email link or telephone call, and was not sending payment links by email at that time. It also reassured guests that their bookings were not at risk of cancellation because of the fraudulent messages.

Keeping guests informed

For reception and reservations teams, the warnings reinforce that accurate booking information alone does not establish that a message is legitimate. The practical task is to make verification straightforward: explain how the property communicates, clarify its payment procedures and give guests a trusted number to call when something feels wrong.

RMS is advising operators to notify guests with upcoming bookings, brief staff and pass suspicious-message reports to its support team. The company says it will waive charges for incident-related emails and SMS messages sent through its platform.

Its advice is to check unexpected requests directly with the accommodation provider using official contact details. Guests who have supplied payment information should contact their financial institution immediately.

Seskis’s message also advises anyone who has clicked a suspicious link to run an antivirus scan and change their passwords.

The full extent of the incident remains under investigation. The published warnings do not establish that every RMS customer, park or guest booking was affected.

For operators fielding worried calls, clear communication is essential. Fraudulent messages impersonating a property can leave guests uncertain about whom to trust, making a straightforward way to verify requests particularly important.