Ogłoszenie ochrona danych osobowych

Announcement: Notice of 03.11.2026

On 02.11.2026 at 09:35, employees of Idobooking.pl, a provider of software for accommodation facilities, including reservation systems, noticed that one of their servers had probably been breached. This server held a database of customer data (accepted reservations). The verification carried out so far has not shown that the attackers gained direct access to the database, and it is not certain that the data was downloaded, but at this time that possibility cannot be ruled out.

Description of the incident

First method of obtaining data: system notifications

Message from Idobooking.pl: As stated in our notice of 3 November 2026, an unauthorized person added to the Go Emc2 sp. z o.o. panel (operating under the trade name TriApart) an account with administrator privileges, to which the system sent notifications about reservations. We identified this method first. Because the notifications relate to specific reservations, we have forwarded them together with the scope of the data (including the guest's first and last name, the dates of stay, and, for some reservations, a phone number and e-mail address).

Second method of obtaining data: downloading reservation lists via API

Idobooking.pl: In the course of further analysis, we confirmed that reservation lists were also downloaded via API in the Go Emc2 sp. z o.o. panel (operating under the trade name TriApart). This is a function used to automatically download a list of reservations. The log entries show the volume of data downloaded, but do not indicate which specific reservations and personal data were involved. For this reason, it is not possible to prepare a list of reservations or the categories of personal data affected by the download.

What this means

Given the nature of this type of incident, it is not always possible to determine the full scope of the breach unambiguously. Therefore, as a precaution, you should assume that more reservations than originally thought have been passed to third parties. If you have not already done so, we recommend warning guests from all ongoing and future reservations, including cancelled ones, about potential fraud attempts (phishing).

The accounts from which the reservation list was downloaded have been deleted and blocked. Since then, they have had no ability to download any further data.

Actions taken by Go Emc2 sp. z o.o., owner of the TriApart brand and user of the IDOBOOKING software

Filed a report with UODO (the Polish data protection authority).
Prepared a report and an information document for customers ("guests").
Published a public notice about the incident.
Placed a paid advertisement in Google Ads.
Attempted to contact the OTA (online travel agency) platforms with which we cooperate.
Determined which data the threat could concern:
- First and last name,
- Reservation date,
- Reservation amount,
- Phone number.

The encrypted substitute e-mail addresses are generated solely for the purposes of a reservation and are blocked once it ends, so sending messages through them is no longer possible.

Messages to the customer via the encrypted substitute addresses are sent exclusively by the booking service, booking.com, which also monitors and blocks the sending of messages to customers/guests at their target address, which we, as the accommodation provider, do not know.

In addition, in reservation systems such as booking.com and expedia.com, it has been specified that the reservation system may only pass on messages from previously defined and approved domains and links.

All communication with guests/customers takes place through the internal communication system of the reservation services and was not connected to communication through the KwHotel system, which is the subject of the reported and described incident.

Invoice data was not accessible, payment data was not accessible, PESEL (national ID) numbers were not accessible, contact/address data was not accessible, and passwords/logins were not accessible.

The matter of the possible incident may concern past, current and future reservations registered up to 01.11.2026 at 16:00.

Below is the text of the notice to the guest/customer, to be used if we are able to obtain or already have an e-mail address that is active for correspondence.

If you have come across this information, please read it carefully:

NOTICE OF A POTENTIAL PERSONAL DATA BREACH

Dear Madam or Sir,

________________________ /hotel name/ with its registered office in ________________________ /address/ (hereinafter the "Controller" or "_________"), fulfilling its obligations as a data controller within the meaning of Art. 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereby informs you that a potential personal data breach has been detected which may have concerned your personal data. Therefore, please read the following notice carefully.

Description of the nature of the potential breach

On 02.11.2026, employees of our IT service provider notified us that one of the servers, which held a database of our Customers' data, had probably been breached. This database also contained your data from accepted reservations. The verification carried out so far has not shown that the attackers gained direct access to the database, and it is not certain that your data was downloaded, but at this time that possibility cannot be ruled out.

The categories of personal data that could potentially have been affected by the security incident are:

data of our facility,
reservation dates and reservation amounts,
data of our hotel guests (provided directly in the reservation, e.g. first name, last name, e-mail address, phone number, or other data you entered in the reservation),
issued accounting documents (invoices, receipts).

At this time we do not confirm that criminals gained access to your personal data. However, in order to exercise due diligence and counteract any possible effects of the identified security incident, we are informing you of the actions taken, as well as the possible negative consequences for you.

Description of the possible consequences of the potential personal data breach

Out of an abundance of caution, we are informing you of the potential consequences should it be determined that your personal data was downloaded by criminals. We will inform you of any confirmation of this in a separate notice (to the best of our knowledge, no such circumstance has occurred at this time).

If such an event is confirmed, a potential consequence of a breach of your personal data could be its use by third parties, among other things, to obtain financial gain at your expense. The personal data used could also potentially serve to induce you to pay non-existent charges, or to extort additional data from you that was not originally covered by the breach, which could in turn result in other obligations being incurred in your name, e.g. online purchases or fraudulently obtained loans from non-bank institutions. The potentially disclosed data could also be used to create online accounts in your name (e.g. on social media or e-mail services), or to rent certain items in your name and then steal them.

Proposed actions you can take to counteract the effects of the potential breach

If you suspect that your personal data has been used without authorization, please contact the appropriate state authorities, e.g. the Police.

Please pay attention to any correspondence addressed to you (using your personal data) from persons claiming to be representatives of our hotel. Please clarify such situations with us promptly by contacting us at the address given at the end of this letter. In particular, please be alert to possible attempts at fraud in which someone impersonates us and cites reservation data, sent by e-mail or online messengers (e.g. WhatsApp), asking you to settle payment for your stay at our hotel or to provide personal data by clicking links in the message. Do not reply to such messages or click the links.

Please also pay attention to any correspondence delivered on paper and read its content carefully, as it may be, for example, a confirmation of a contract that you never concluded, or a false demand for payment in connection with reservations made at our facility. Any such events should be verified immediately with the entities that are parties to the contracts concerned, and in doubtful cases reported to the Police. We also remind you that for consumer contracts concluded at a distance, you will usually have the right to withdraw from the contract within 14 days without incurring any consequences.

If you receive electronic (e-mail) notices of a similar nature to those described above, please pay particular attention to:

suspicious attachments in e-mails (attachments should not be sent as ZIP or RAR archives),
suspicious links in the body of the message,
requests to provide additional personal data (e.g. to confirm your identity).

Such e-mails may contain malicious software (e.g. viruses, trojans) and may also be used to attempt to extort further personal data from you, e.g. bank account numbers, credit card numbers, or login credentials (e.g. usernames and passwords). For this reason, we recommend special caution when opening such messages. We also recommend using antivirus software with an always up-to-date virus signature database.

Please also pay attention to the passwords you use when using Internet resources (e.g. social media accounts, e-mail accounts, portals, online banking). These passwords should not contain easy-to-guess words or parts of words, in particular those based on your personal data (e.g. first names, last names, date of birth, PESEL number, series and number of an identity document, phone number).

If you suspect that your data has been used without authorization, you can also:

a) Check your credit history at the Credit Information Bureau (BIK) – an institution that collects and processes data on all loans taken out at banks and credit unions (SKOK). BIK shows information about loans repaid on time and payment arrears. Detailed information is available at: https://www.bik.pl/

b) Check your data in the National Debt Register (KRD) – KRD makes it possible to monitor the register of inquiries concerning credit applications. Detailed information is available at: https://krd.pl/

Because of the detailed description provided, please also do not disclose the contents of this letter to untrusted persons, as this could make it easier for unauthorized persons to take action aimed at misusing your personal data.

Description of the security measures applied to remedy the personal data breach or minimize its possible negative effects

Immediately after discovering the incident described above, together with our IT service provider we took action to counter the incident and its potential effects as quickly as possible. In particular, we launched our internal procedure for responding to potential personal data breaches, shut down the IT resources affected by the attack and replaced them with new, additionally secured ones, and verified user accounts to make sure the attackers no longer have access to our databases. Our internal services responsible for personal data protection were informed of the incident, as were the authorities: the Police, CERT, and the President of the Personal Data Protection Office (UODO).

Contact with the Data Controller

If you have any additional questions, we are at your disposal.

We are monitoring the situation related to the identified incident on an ongoing basis and, should there be any further findings, we will pass them on to you promptly. If you have additional questions, you can contact us

by e-mail at: [hotel's contact e-mail address]

or by phone at: [hotel's contact phone number]

Yours sincerely,

…………………………………………

Note: the Polish original contained numerous typos, so a few phrases were interpreted from context. I can also adjust the register (e.g. more formal, or a shorter guest-facing version) if you like.