TUI announced a breach of data has impacted its Belgian operations after tourists reported receiving counterfeit WhatsApp texts listing personal information about their reservations. The firm said several messages contained specific travelers’ full names, the hotels they booked and exact dates of travel. In some instances, the scammers also seemed aware of the total booking price.
An international team is probing the TUI data breach while the travel firm tries to determine the extent of the exposure and the number of impacted customers. The investigation is still ongoing, and TUI has not revealed how many customers are affected or what types of personal data might have been leaked.
On October 11, Dutch news agency ANP reported that TUI stated the fraudulent activities seemed to target Belgian customers. At that time, there was no evidence of similar issues affecting travelers in the Netherlands. TUI has not confirmed whether hackers directly infiltrated its systems or if the data used by scammers originated from the breach.
TUI advises customers to ignore unexpected payment requests and avoid clicking suspicious links sent via WhatsApp, email, or text. The company’s security guidelines clarify that it never requests payment for bookings through unsolicited bank transfers. Customers are also urged not to share sensitive details like booking numbers, lead passenger surnames, or travel dates in response to dubious inquiries.
If customers receive unexpected reservation messages, they should verify their myTUI account directly or contact the company via its official website or customer service. Belgium’s Safeonweb cybersecurity service echoes this advice, recommending that payment requests be checked through the original booking platform instead of using links or details from unsolicited messages.
Even if a message includes correct hotel names, reservation dates, or payment amounts, it does not guarantee authenticity. Customers who have shared banking details or made fraudulent payments should contact their bank immediately. In Belgium, Card Stop is available at 078 170 170, and victims are advised to report losses to the police.
Travelers cannot rely solely on accurate reservation information when deciding whether a payment request is authentic. This caution applies broadly to online bookings. A scammer possessing correct details can mimic legitimate messages effectively, making it difficult for users to spot a fraudulent request without checking official channels.