A cybersecurity breach at accommodation software provider RMS Cloud has left multiple Australian holiday park operators dealing with reputational damage and regulatory questions after scammers used real guest booking data to send phishing messages.
RMS Cloud provides cloud-based property management and booking systems to more than 6,000 hotels, holiday parks, and serviced apartments globally. The company confirmed it is investigating phishing messages sent via WhatsApp, SMS, and email that “reference genuine booking information” and request payment details.
“Our teams are actively investigating the activity and taking steps to contain it, protect customer information and support affected customers and integration partners. No payment card information has been exposed from RMS,” RMS Cloud said.
BIG4, Reflections Holidays, G’day Parks, and Summerstar Tourist Parks are among the operators affected, according to ABC News.
A BIG4 spokeswoman said the breach originated from “a third-party platform which is used by some of the parks within our network, as well as a number of other accommodation providers and groups.”
“This has resulted in some guests receiving fraudulent messages asking for credit card or payment details,” she added.
Cherie Midson, who manages a holiday park in Victoria’s East Gippsland, said guests began contacting her business after receiving messages containing accurate names and dates of stay. “The messages started going out last night and the calls started coming in today. Some of the details, like names and dates of stay, are correct,” Midson said.
Midson said she reported the matter to Scamwatch and raised concerns about the flow-on effects. “It’s very worrying. Our details are being used, which reflects on us as a business. We’re concerned our guests could fall victim to the scam, and if they do, our business will be associated with that. That’s a real worry for us,” she said.
Reflections Holidays sent text messages to guests warning them not to click links or share payment details. Summerstar Tourist Parks issued a similar warning on social media.
Read more: Third-party breaches push brokers toward vendor risk
The holiday parks did not suffer a direct breach of their own systems. Yet they face reputational harm, customer remediation costs, and potential notification obligations under the Privacy Act 1988.
Whether a standard cyber policy responds depends on how it defines “computer system.” Some wordings explicitly include third-party networks and cloud platforms. Others leave outsourced infrastructure unclear.
Vicky Sheridan, senior claims specialist for cyber at AXA XL in Australia, said the trend is accelerating. “We’re also seeing growing exposure to cyber risks arising from third-party technology providers,” Sheridan said. She noted that incidents involving shared platforms can “trigger cascading effects” across interdependent organisations.
Earlier in 2026, a single vendor compromise at financial services firm youX created notification obligations for roughly 800 broker firms and more than 90 lenders, demonstrating how quickly a third-party breach can spread across an industry.
The Office of the Australian Information Commissioner (OAIC) recorded 1,205 data breach notifications in 2025, an all-time high and an 8% increase on the prior year. Of those, 716 were attributed to malicious or criminal attacks. The OAIC has noted that multi-party breaches stemming from cloud or software providers represent a growing share of notifications.
Research published by the Council of Small Business Organisations Australia (COSBOA) in February 2026 found that only 47% of hospitality respondents used unique passwords, 37% had cloud-based backups, and roughly one-third had multifactor authentication on their email systems.
Cybersecurity expert Professor Daswin de Silva said travel data was “highly valuable” because it contained detailed information about a traveller’s identity.
“There’s an assumption that people who travel have financial capacity, which makes them appealing targets for cybercriminals,” he said.
The Australian Competition and Consumer Commission’s (ACCC) Scamwatch service received more than 13,000 reports of phishing scams in the first three months of 2026.
Read more: Perth arrests reveal the supply chain blind spot in Australian cyber cover
For brokers advising hospitality and tourism clients, the RMS Cloud breach is a prompt to check whether existing cyber policies cover losses that originate at a third-party vendor and whether clients have adequate vendor risk management clauses in their own supplier contracts.
