The short version
NightsBridge believes an AI agent carried out an attack that reached future booking data. The company has said it serves 10,000 clients across 41 countries. The breach could enable phishing and reservation‑hijacking, but no payment details were exposed.
What happened
NightsBridge, a South African tech firm that links hotels, guesthouses and lodges to online booking sites, sent an email alert after unusual activity at 20:55 on 2 November.
Managing director Theresa Emerick confirmed the alert was authentic and said the breach was identified at 21:30.
The attack exploited a vulnerability in NightsBridge’s codebase, giving the attacker access to a back‑office summary list of channel‑partner bookings across several partner channels.
The data accessed included future booking dates and reference numbers but did not contain payment information or other sensitive guest details.
NightsBridge stopped the breach a day before any phishing attempts began and warned clients that scammers were already trying to use the information to craft realistic WhatsApp spoof messages.
The background
Earlier in the year Booking.com notified South African users that unauthorised parties may have accessed booking details, names, emails, addresses and phone numbers.
A June breach at Johannesburg‑based HTI showed a Russian threat actor using an AI‑driven attack to compromise the NebulaPMS platform, prompting a generative AI tool to act as a white‑hat tester.
What it means for owners and operators
Owners and operators should expect an increase in phishing messages that reference booking dates and numbers, especially on WhatsApp.
If guests receive such messages, there is a risk of reservation hijacking, where scammers change or cancel genuine bookings and demand payment.
The breach may lead to chargebacks, wasted staff time and damage to brand trust, even though no payment data was exposed.
Our take
Analysis by Infercline · How it breaks
No card data leaked, yet dates and reference numbers are all a scammer needs to sound like your hotel.
NightsBridge sits between hotels, guesthouses and lodges and the online booking sites, keeping availability in step across channels. That middle position is what made the breach useful to an attacker. A flaw in its code opened a back-office list of channel-partner bookings; the company noticed unusual activity at 20:55 on 2 November and identified the breach at 21:30.
What leaked looks harmless: future booking dates and reference numbers, with no payment details. The failure mode is that this is exactly the context a scammer needs. A WhatsApp message quoting a real date and a real reference reads as genuine, so a guest pays or hands over details, and reservations can be hijacked. Earlier breaches at Booking.com and HTI show the sector is a repeat target, with AI driving at least one of those attacks.
The same weak point exists in any business that shares booking or order references with a platform. No reference number should count as a secret or as proof of identity. Guests and staff carry the cost first, through chargebacks and wasted time, so the fix is a process one: confirm any payment request through a second channel before money moves, and ask NightsBridge which patch closed the flaw.
What to do in your business tomorrow
- Tell reservations and front desk staff today: any chat or text quoting a booking date or reference number gets checked against your own booking records before anyone acts on it.
- Require a second staff member to confirm every payment request and every reservation change before it goes through.
- Tell guests with future bookings that your property never asks for payment or personal details by chat.
- Check which booking dates, reference numbers and payment details your staff can see on screen, and remove what they don't need.
Sources
- mybroadband.co.za: AI agent believed to have breached South African platform that handles bookings for 10,000 hotels, guesthouses, lodges and B&Bs